CVE-2023-42247

Executive Summary

CVE-2023-42247 is a Cross-Site Scripting (XSS) vulnerability in Selesta Visual Access Manager versions prior to 4.42.2, reachable via the monitor/s_monitor_map.php web endpoint. Visual Access Manager is a web-based access control and building-management platform, so the flaw is exposed through the product's public-facing monitoring interface. Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of an authenticated user's browser session, potentially leading to session hijacking, unauthorized configuration changes, and compromise of the underlying access-control system. No CVSS score, proof-of-concept, or patch evidence has been published, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

The NVD description is sparse and provides two concrete facts: the affected product is Selesta Visual Access Manager and the vulnerable page is monitor/s_monitor_map.php, located within the monitoring/map module of the web application. No specific parameter names, request methods, or payload constraints are documented in the public advisory data, so the analysis must remain at the vulnerability-class level.

Cross-Site Scripting (CWE-79) occurs when an application reflects or stores user-controlled input without adequate sanitization and then renders it in an HTML context without proper output encoding. In the case of monitor/s_monitor_map.php, the most plausible mechanism is a reflective XSS condition in which one or more query-string parameters accepted by the PHP script are embedded in the generated HTML response (for example, in a JavaScript context or an HTML attribute) without validation or encoding. An attacker would craft a URL containing an obfuscated or plaintext script payload, and when a victim — typically a Visual Access Manager operator or administrator — opens the link, the browser executes the injected code in the application's origin.

The attack surface is the HTTP listener serving the Visual Access Manager web console. If the management interface is exposed to untrusted networks or to the general corporate LAN without authentication or segmentation, the exposure increases significantly. Since the vulnerable resource is a "monitor map" page, it is likely used by operators for live status visualization, which increases the chance that legitimate users visit it routinely and that a malicious link would be opened without suspicion.

No code-level details (function names, variables, or vulnerable parameters) are available in the NVD description or CNA title. Therefore, any more granular explanation would be speculative; the absence of detail is itself a risk factor because it indicates incomplete vendor disclosure.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2023-42247. The attack chain below is inferred from the vulnerability class (reflected XSS) and the disclosed endpoint; it should not be read as a validated exploit sequence.

1. Reconnaissance / target identification. An attacker locates exposed Visual Access Manager instances using internet-wide scanning or search-engine queries that match the product's web interface (for example, title-based Shodan queries or crawling for monitor/s_monitor_map.php). Because the product is an access-control management platform, exposed instances may be present on building-management networks that are less strictly monitored than typical IT infrastructure.

2. Flaw triggering. The attacker submits crafted HTTP requests to monitor/s_monitor_map.php containing XSS payloads in the query string. Because the vulnerable parameter is not publicly documented, the attacker would iterate over candidate parameters, observing whether input is reflected unescaped in the response body. A reflected XSS condition is confirmed when a payload such as an HTML script tag or an event-handler attribute is returned verbatim in the page source.

3. Payload / execution method. At the vulnerability-class level, the attacker would deliver a crafted URL (via phishing, a compromised page, or a third-party messaging channel) to an authenticated operator. When the victim's browser renders the response from monitor/s_monitor_map.php, the injected JavaScript executes with the origin and session context of the Visual Access Manager application. Typical payloads exfiltrate session cookies (document.cookie), proxy authenticated requests, or perform actions on behalf of the victim — all constrained by the trust boundary of the vulnerable origin.

4. Post-exploitation impact. With the victim's session token, the attacker can impersonate the operator inside the Visual Access Manager web console. Depending on the privileges of the compromised account, this could allow changes to monitoring views, access-schedule configuration, user accounts, or other settings managed by the platform. In the worst case, compromise of an administrator account undermines the integrity of the physical-access-control system, which can translate into unauthorized physical access to facilities.

Impact Assessment

The business impact of CVE-2023-42247 is significant because the affected product sits at the intersection of IT and physical security. A cross-site scripting flaw in an access-control management console can be chained with session theft or CSRF-style requests to achieve administrative control of the platform. The NVD has not assigned a CVSS score (CVSS: N/A), which complicates risk prioritization; however, the absence of a score is likely a reflection of incomplete disclosure rather than low severity.

The EPSS score is 0.00235, placing the vulnerability in the 14.6th percentile of exploited CVEs — meaning that as of the scoring date, exploitation was not widespread. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, and no threat-actor campaigns or in-the-wild exploitation were identified in tracked sources. Still, the vulnerability affects an unpatched product with no confirmed fix, and the presence of a defined affected-version boundary (< 4.42.2) implies that a corrective release exists or was planned.

Blast radius includes all tenants of a single Visual Access Manager deployment: every operator session that touches the monitoring-map page is a potential victim. Downstream consequences include loss of confidentiality (monitoring data, facility layout, access logs), loss of integrity (unauthorized changes to access permissions), and — in environments where physical access is tied to life-safety or regulatory compliance — legal and audit exposure.

Detection Guidance

The following detections are tuned to the disclosed endpoint monitor/s_monitor_map.php and to generic XSS indicators. They should be adapted to local logging schemas (web-server access logs, reverse-proxy logs, or WAF logs) and validated against baseline traffic before deployment in production. Values such as rule IDs and alert thresholds are placeholders.

Sigma Rule

title: Selesta Visual Access Manager XSS Attempt - s_monitor_map.php
id: b0aa2d14-9e2c-4d5f-8a7c-2f3c8a1b4e17
status: experimental
description: Detects HTTP requests to the s_monitor_map.php endpoint containing common XSS payload indicators. Related to CVE-2023-42247.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42247
author: Valtersit Threat Intelligence
date: 2024/01/01
tags:
    - attack.t1190
    - attack.t1059.007
    - cwe.79
logsource:
    category: webserver
    product: apache
detection:
    selection_path:
        cs-uri-path|contains: monitor/s_monitor_map.php
    selection_payload:
        cs-uri-query|contains:
            - '<script'
            - '<img'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - 'alert('
            - 'prompt('
            - 'confirm('
            - '%3Cscript'
            - '%3cscript'
    condition: selection_path and selection_payload
falsepositives:
    - Legitimate security scanning activities
    - Administrative testing of the monitoring module
level: high

YARA Rule

rule selesta_vam_xss_attempt_cve_2023_42247
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects XSS payloads targeting Selesta Visual Access Manager s_monitor_map.php (CVE-2023-42247)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-42247"
        severity = "high"
    strings:
        $endpoint = "s_monitor_map.php"
        $xss1 = "<script"
        $xss2 = "<img"
        $xss3 = "onerror="
        $xss4 = "onload="
        $xss5 = "javascript:"
        $xss6 = "alert("
        $xss7 = "document.cookie"
        $xss8 = "prompt("
        $xss9 = "confirm("
        $encoded = "%3Cscript"
    condition:
        uint16(0) == 0x0a0d or filesize < 1MB
        and $endpoint
        and any of ($xss*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET LOCAL Selesta Visual Access Manager XSS Attempt (CVE-2023-42247)"; flow:established,to_server; content:"s_monitor_map.php"; http.uri; pcre:"/(%3C|<)(script|img)|on(error|load)=|javascript:|(alert|prompt|confirm)\(/i"; classtype:web-application-attack; sid:20234247; rev:1; metadata:created_at 2024_01_01, updated_at 2024_01_01;)

Elastic Detection

The following EQL query targets ECS-compliant web-proxy or web-server logs (url.path and url.query fields):

any where url.path == "/monitor/s_monitor_map.php" and
  wildcard(url.query, "*<script*") or
  wildcard(url.query, "*<img*") or
  wildcard(url.query, "*onerror=*") or
  wildcard(url.query, "*onload=*") or
  wildcard(url.query, "*javascript:*") or
  wildcard(url.query, "*alert(*") or
  wildcard(url.query, "*%3Cscript*") or
  wildcard(url.query, "*%3cscript*")

Splunk SPL Query

index=web sourcetype=access_combined uri_path="*/monitor/s_monitor_map.php*"
| eval xss_signal=case(
    lower(uri_query) LIKE "%<script%" OR
    lower(uri_query) LIKE "%<img%" OR
    lower(uri_query) LIKE "%onerror=%" OR
    lower(uri_query) LIKE "%onload=%" OR
    lower(uri_query) LIKE "%javascript:%" OR
    lower(uri_query) LIKE "%alert(%" OR
    lower(uri_query) LIKE "%prompt(%" OR
    lower(uri_query) LIKE "%confirm(%" OR
    lower(uri_query) LIKE "%3cscript%", "true", 1=1, "false")
| where xss_signal=="true"
| stats count min(_time) max(_time) by src_ip, uri_path, uri_query, status
| sort - count

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="100472" level="10">
    <decoded>apache-access</decoded>
    <match>s_monitor_map.php</match>
    <regex>(\%3C|<)script|onerror=|onload=|javascript:|(alert|prompt|confirm)\(</regex>
    <description>CVE-2023-42247: Possible XSS attempt against Selesta Visual Access Manager (s_monitor_map.php)</description>
    <group>web_application_attack,xss,</group>
    <mitre>
      <id>T1059.007</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for CVE-2023-42247 is 0/4: no patch evidence was identified from any tracked source, no vendor advisory is available, and no fixed version has been confirmed. The NVD description states that versions prior to 4.42.2 are affected, which implies that version 4.42.2 is the expected corrective release; however, this could not be verified against vendor channels at the time of writing.

Immediate mitigations:

• Restrict network access to the Visual Access Manager web console to trusted administrative networks or VPN segments using firewall ACLs; do not expose monitor/s_monitor_map.php directly to the internet.
• Deploy or tune a web application firewall (WAF) with XSS-signature rules, especially for the monitor/ path.
• Enforce strong authentication on the management interface and ensure session cookies use HttpOnly and Secure attributes; if a session cookie lacks HttpOnly, the XSS risk is compounded by session theft.
• Educate operators about phishing links targeting the management console; the monitoring-map page is a high-value lure.

Patch / upgrade steps:

• Contact Selesta support (or an authorized reseller) to request remediation guidance and verify whether version 4.42.2 or later resolves the issue.
• If a fixed release is available, upgrade Visual Access Manager in a maintenance window, with a rollback plan and verified backup of configuration and database.
• Re-audit the instance with an authenticated web-application scanner after the upgrade to confirm that the s_monitor_map.php endpoint no longer reflects payloads.

Long-term hardening:

• Apply strict input validation and context-aware output encoding for all user-supplied data in the application; this is a development-level fix and should be tracked with the vendor.
• Deploy Content-Security-Policy (CSP) headers, X-Content-Type-Options, and X-Frame-Options on the web console to reduce the impact of future client-side injection flaws.
• Segment building-management and access-control networks from general corporate IT where feasible, and monitor east-west traffic to those segments.
• Maintain vendor-supported versions and subscribe to the vendor's security advisory channel so that a confirmed patch, when released, is applied promptly.
• Continue to monitor CISA KEV, FIRST EPSS, and NVD for updates to this CVE, as enrichment data may appear after initial disclosure.

References

• NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2023-42247
• MITRE CVE List — https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42247
• FIRST EPSS (CVE-2023-42247, score 0.00235) — https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2023-42247 NOT listed) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

As of the report date, no vendor advisory, researcher analysis, proof-of-concept, or evidence of exploitation in the wild has been published for CVE-2023-42247. In the absence of a public PoC and a confirmed patch, the detection content above is based on the disclosed endpoint and the XSS vulnerability class, and should be treated as an initial hunting baseline rather than a definitive indicator set.