CVE-2023-42245

Executive Summary

CVE-2023-42245 is a Cross-Site Scripting (XSS) vulnerability affecting Selesta Visual Access Manager versions prior to 4.42.2, identified in the monitor/s_scheduledfile.php component. Organizations operating an affected release of this web-based access management product are exposed to client-side script injection, which can lead to session hijacking, credential theft, or unauthorized manipulation of access-control settings in the context of an authenticated user. At the time of writing, no official patch artifact, public exploit, CISA KEV listing, or vendor advisory has been confirmed; the EPSS score (0.00233) indicates a low current likelihood of exploitation in the wild.

Technical Analysis

The NVD description for CVE-2023-42245 is deliberately sparse and contains only the following factual statement: "Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_scheduledfile.php." No CWE identifier, CVSS vector/score, affected parameter name, authentication requirement, or exploit-detail is provided by the authoritative record. Consequently, the technical analysis below is derived strictly from the vulnerability class (XSS) and the disclosed endpoint path; no implementation-specific details (function names, sanitization routines, database queries, or parameter identifiers) are fabricated.

The vulnerable component is monitor/s_scheduledfile.php. The path structure implies a PHP-based web application module named monitor, and the filename suggests functionality related to scheduled file operations — for example, listing, uploading, or processing files on a schedule. In typical PHP XSS scenarios, user-controlled input — whether supplied via HTTP query strings, POST parameters, or cookie values — is incorporated into the generated HTML or JavaScript response without adequate output encoding or input validation. When a browser renders the response, the injected script executes with the origin and privilege context of the Visual Access Manager application.

From an attack-surface perspective, the endpoint is reachable over HTTP/HTTPS and is therefore exposed to any network segment that can reach the VAM web interface. If the application is deployed on an internet-facing management portal, the attack surface is significantly broader. Because Visual Access Manager is an access-management product, the affected page may be used by operators or administrators, meaning the XSS payload would execute in a high-privilege web session. However, the NVD description does not specify whether the flaw is reflected or stored, whether authentication is required, or whether any built-in web application firewall (WAF) protections are present. Insufficient technical detail is available to make those distinctions conclusively.

The absence of CVSS scoring, CWE classification, and patch evidence further limits the depth of the analysis. The EPSS score of 0.00233 (14.4th percentile of exploited CVEs) suggests that, within the EPSS model, the probability of exploitation in the wild is low relative to other known vulnerabilities. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, there is no Nuclei template, and no exploit code has been publicly identified.

Exploitation Scenarios

The following attack chain is inferred from the XSS vulnerability class because no public PoC or technical write-up is available for CVE-2023-42245.

1. Reconnaissance and target identification. An attacker identifies Selesta Visual Access Manager deployments using internet-wide search engines (e.g., Shodan dorks for http.title:"Visual Access Manager") or by fingerprinting the application's distinctive login page and static resource paths. Once a candidate host is found, the attacker confirms the presence of the vulnerable component by requesting monitor/s_scheduledfile.php and observing the server response (HTTP 200 vs. 404, application-specific error pages).

2. Triggering the vulnerability. The attacker crafts a malicious HTTP request to monitor/s_scheduledfile.php. Because the specific vulnerable parameter is undisclosed, the attacker would either fuzz likely input fields (query-string parameters, POST bodies) or wait for a public PoC. The underlying flaw class means that at least one input value is reflected into the page response without proper output encoding.

3. Payload delivery and execution. The attacker supplies a classic XSS payload — for example, a <script> block, an event-handler attribute such as onerror= or onload=, or a javascript: URI — as the value of the vulnerable input. If the vulnerability is reflected, the attacker socially engineers a victim (typically an authenticated VAM operator) into opening the crafted link. If the flaw is stored, the payload is persisted in the application (e.g., in a scheduled-file name or description field) and executed when any user loads the affected page. The script then runs in the browser session of the victim, under the VAM application origin.

4. Post-exploitation impact. The injected script can exfiltrate session cookies, CSRF tokens, or page content to an attacker-controlled server. In an access-management platform, this may enable session hijacking, impersonation of an administrator, modification of access-control assignments, creation of rogue user accounts, or pivoting to backend infrastructure that VAM manages. Because the NVD description does not define the privilege level required to reach the vulnerable page, the impact could range from low-privilege user compromise to full administrative takeover.

It must be reiterated: no public PoC, exploit code, or Nuclei template exists for this CVE. The chain above is a class-level inference and should be treated as such by analysts.

Impact Assessment

The business impact of CVE-2023-42245 is contingent on the role of Visual Access Manager within the affected organization. As an access-management product, VAM likely sits at the intersection of physical and logical access control — managing credentials, badges, schedules, or door/perimeter permissions. A successful XSS attack against this platform could therefore have consequences beyond the web application itself, including unauthorized access to facilities or systems.

Because the NVD record does not include a CVSS vector or score, no base, temporal, or environmental subscores can be referenced. The only quantitative signal available is the EPSS probability score of 0.00233, which indicates a low predicted likelihood of exploitation in the wild. The absence of CISA KEV listing further suggests that no U.S. federal civilian agency has reported in-the-wild exploitation of this CVE.

The blast radius is bounded by the deployment context:

• Internet-facing VAM instances: Highest risk; any unauthenticated attacker can reach the vulnerable endpoint.
• Internal/intranet VAM instances: Lower exposure; attacker must first compromise the network perimeter or gain foothold via phishing.
• High-privilege operator usage: If administrators regularly use the affected page, the impact of a single successful XSS is amplified by the privileges of the victim session.

Patch confidence for this CVE is rated 0/4, meaning no tracked source (vendor advisory, git commit, release notes, or third-party bulletin) confirms a fix. The NVD description phrasing "Visual Access Manager < 4.42.2" implies that version 4.42.2 resolves the issue, but this is an inference, not a verified patch reference.

Detection Guidance

The detection rules below target the disclosed endpoint and common XSS payload markers. They are intended to detect attempted exploitation in HTTP logs and network traffic; they will also flag legitimate security scanners and penetration tests.

Sigma Rule

title: Selesta Visual Access Manager XSS Attempt via s_scheduledfile.php
id: 7a4c5f1e-9c2b-4a3d-8e6f-1c2d3e4f5a6b
status: experimental
description: Detects HTTP requests targeting s_scheduledfile.php with common XSS payload markers.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42245
author: Valters IT Threat Intelligence
date: 2025-04-05
logsource:
    category: webserver
    product: generic
detection:
    selection_path:
        cs-uri-path|contains: s_scheduledfile.php
    selection_payload:
        - cs-uri-query|contains:
            - "<script"
            - "javascript:"
            - "onerror="
            - "onload="
            - "alert("
            - "<svg"
    condition: selection_path and selection_payload
falsepositives:
    - Active web vulnerability scanners
    - Authorized penetration tests using standard XSS payloads
    - Manual security testing by administrators
level: high
tags:
    - attack.t1190
    - cve.2023-42245
    - xss

YARA Rule

/*
    CVE-2023-42245 - Selesta Visual Access Manager XSS
    Detects log entries or captured payloads that reference the
    vulnerable endpoint together with common XSS markers.
*/
rule CVE_2023_42245_Selesta_VAM_XSS
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects XSS payloads targeting monitor/s_scheduledfile.php in Selesta Visual Access Manager"
        cve = "2023-42245"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-42245"
        date = "2025-04-05"

    strings:
        $uri = "s_scheduledfile.php"
        $xss1 = "<script"
        $xss2 = "javascript:"
        $xss3 = "onerror="
        $xss4 = "onload="
        $xss5 = "alert("
        $xss6 = "<svg"

    condition:
        $uri and 2 of ($xss*)
}

Suricata IDS Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2023-42245 Selesta Visual Access Manager XSS via monitor/s_scheduledfile.php"; flow:to_server,established; content:"s_scheduledfile.php"; http.uri; pcre:"/(?:<script|javascript:|onerror=|onload=|<svg|alert\()/i"; classtype:web-application-attack; reference:cve,2023-42245; sid:2023451; rev:1;)

Elastic Detection

The following EQL detection is designed for Elastic Security/Endpoint and matches web requests containing the vulnerable endpoint combined with common XSS payload fragments:

any where
  (
    url.path : "*s_scheduledfile.php*" or
    http.request.uri : "*s_scheduledfile.php*"
  )
  and
  (
    wildcard(url.query, "*<script*") or
    wildcard(url.query, "*javascript:*") or
    wildcard(url.query, "*onerror=*") or
    wildcard(url.query, "*onload=*") or
    wildcard(url.query, "*alert(*") or
    wildcard(url.query, "*<svg*")
  )

Note: if the payload is delivered in a POST body rather than a query string, an additional rule tier should inspect http.request.body.content using the same wildcard patterns.

Splunk SPL Query

index=web* OR index=proxy*
  ( uri_path="*/s_scheduledfile.php*" OR url="*/s_scheduledfile.php*" )
| regex uri_query="(?i)(<script|javascript:|onerror=|onload=|<svg|alert\()"
| eval threat="CVE-2023-42245 XSS attempt"
| table _time src_ip dest host uri uri_query status threat
| sort - _time

If query-string logging is unreliable, broaden the query by searching _raw:

index=web* OR index=proxy*
| regex _raw="(?i)s_scheduledfile\.php[^\"]*(<script|javascript:|onerror=|onload=|<svg|alert\()"
| table _time src_ip dest host uri status
| sort - _time

Wazuh OSSEC Rule

<group name="web,attack,xss,">
    <rule id="100345" level="10">
        <if_sid>31100</if_sid>
        <match>s_scheduledfile.php</match>
        <regex>(\x3cscript|javascript:|onerror=|onload=)</regex>
        <description>CVE-2023-42245: Selesta Visual Access Manager XSS attempt via monitor/s_scheduledfile.php</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>web_application_attack,xss,cve_2023_42245,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch status: UNPATCHED (confidence 0/4). No vendor advisory, release note, git commit, or third-party patch source was identified during collection. The following guidance is therefore layered and should be applied in order of immediacy.

1. Immediate mitigations (no patch available):

   • Deploy or update web-application firewall (WAF) rules to block requests to /monitor/s_scheduledfile.php containing XSS markers (<script, javascript:, onerror=, onload=, <svg, alert().
   • If the VAM web interface is internet-facing, restrict access by IP allowlist or move it behind a VPN / reverse proxy with mandatory authentication.
   • If the monitor module is not business-critical, disable access to monitor/s_scheduledfile.php at the web-server level (e.g., deny rule in Apache/Nginx virtual host).
   • Implement a strict Content-Security-Policy (CSP) header with script-src 'self' to reduce the impact of any XSS that bypasses the WAF.

2. Patch / upgrade steps:

   • Contact Selesta support directly to request a hotfix or confirmation of the affected status of 4.42.2.
   • Based on the NVD description, upgrade to version 4.42.2 or later only after the vendor confirms the fix; do not assume that 4.42.2 remediates the flaw solely from the phrasing in the description.
   • Verify the integrity of the downloaded update against vendor checksums before deployment, and deploy outside of business hours with a rollback plan.

3. Long-term hardening:

   • Adopt secure coding practices (output encoding, context-aware escaping, input validation) for any custom modifications to the VAM platform.
   • Run periodic authenticated web-application security scans against the VAM instance and track discovered findings in the vulnerability-management workflow.
   • Continuously monitor web-server and IDS/IPS logs for attempts against s_scheduledfile.php; tune the detection artifacts above to the environment.
   • Track this CVE in the vulnerability-management program and re-evaluate patch confidence on a 30-day cadence, since a vendor advisory may appear after the initial disclosure.

References

Due to the sparse disclosure, authoritative references are limited to vulnerability registries and general frameworks. No vendor advisory, researcher blog post, or threat-actor campaign write-up exists at the time of writing.

1. NVD — CVE-2023-42245: https://nvd.nist.gov/vuln/detail/CVE-2023-42245
2. CVE.org — CVE-2023-42245 Record: https://cve.org/CVERecord?id=CVE-2023-42245
3. FIRST — EPSS Score Lookup (EPSS = 0.00233): https://www.first.org/epss/
4. MITRE ATT&CK — T1190, Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2023-42245 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-actor activity: None identified. CVE-2023-42245 is not on the CISA KEV list, and no exploit-in-the-wild evidence, malware integration, or ransomware campaign has been publicly documented for this CVE as of the report date.