CVE-2023-42249

Executive Summary

CVE-2023-42249 is a Cross-Site Scripting (XSS) vulnerability in Selesta Visual Access Manager versions prior to 4.42.2, reachable through the vam/vam_visits.php endpoint. Organizations that deploy Visual Access Manager as a web-accessible facility or access-control administration platform are affected. Successful exploitation enables an attacker to execute arbitrary script in the context of an authenticated user's browser session, which can lead to session hijacking, administrative account takeover, and tampering with access-management records. No CVSS score, CWE identifier, or vendor patch information is available from the NVD record, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at the time of writing.

Technical Analysis

The NVD description states that "Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via vam/vam_visits.php." The vulnerable component is the visits-management module exposed at the vam/vam_visits.php URI path. XSS of this class occurs when the application fails to neutralize or encode user-supplied input before it is included in dynamically generated HTML output, or before it is stored and later rendered to other users.

Insights that can be derived from the available data are limited: the record does not specify whether the flaw is reflected (payload delivered via a crafted URL/query string) or stored (payload persisted on the server and rendered to later visitors of the page), and no CWE or CVSS data is attached. The absence of an assigned CWE or vector in the NVD entry indicates that the CNA (for this record, the CNA is listed as "Unknown" with no title) provided minimal enrichment. Based strictly on the described mechanism, the flaw falls into the CWE-79 class of improper neutralization of input during web page generation — the canonical XSS weakness.

Attack surface assessment: Visual Access Manager is a web-based application, meaning the vulnerable endpoint is exposed to any network path that can reach the web server — typically the corporate network, a segmented management network, or the public internet if the application is externally published. Because the endpoint resides under the vam/ directory, it shares the application's authentication context; however, XSS is frequently exploitable by unauthenticated or low-privileged attackers who trick a privileged user into visiting a crafted URL (reflected case) or who submit a malicious value that is later displayed (stored case).

The patch condition is noteworthy: the description uses the "< 4.42.2" version qualifier, implying that version 4.42.2 includes the corrective fix. However, patch confidence stands at 0/4, meaning no tracked source — vendor advisory, changelog, commit, or security bulletin — has provided verifiable patch evidence. With no patch source, no vendor fix text, and no workaround documentation, enterprise defenders must treat this as an unpatched or undocumented-fix scenario and rely on compensating controls.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2023-42249. The following attack chain is therefore inferred from the vulnerability class (XSS) and the single known endpoint, and is provided for defensive planning rather than as a confirmed reproduction.

1. Reconnaissance / target identification: An attacker enumerates internet- or network-facing instances of Selesta Visual Access Manager using search-engine and Shodan dorks such as http.title:"Visual Access Manager", "vam_visits.php", or "Selesta" "Visual Access Manager". Alternatively, path fuzzing of the web root may reveal the vam/ application directory and the vam_visits.php script. The attacker fingerprints the version to confirm it is below 4.42.2.

2. Flaw-class trigger: Because XSS results from unsanitized or unencoded user input, the attacker crafts input destined for the vam_visits.php handler — either as a query-string parameter in a crafted link or as a submitted form field value that the page later reflects or renders. The precise parameter names are not disclosed in the NVD description, so they cannot be enumerated here. The attacker's input is a JavaScript-bearing payload designed to survive HTTP transport and HTML parsing.

3. Payload execution: At the vulnerability-class level, the payload will typically use an HTML tag or event handler that executes script without user interaction — for example <script>...</script>, <img src=x onerror=...>, or javascript: URIs — possibly URL-encoded to bypass weak input filters. The payload executes in the victim's browser with the origin and privileges of the Visual Access Manager application. Delivery of a reflected payload requires the victim (usually an administrator) to click the crafted link; a stored payload executes when any user opens the affected page.

4. Post-exploitation impact: With script running in the application's origin, the attacker can steal session cookies (unless HttpOnly is enforced), read and exfiltrate page contents, submit requests on behalf of the authenticated victim, and interact with administrative functions. Given the product's purpose as an access manager, the attacker could alter visitor records, modify access-control configuration, or create rogue accounts — potentially bridging cyber compromise into physical or logical access-control tampering.

In short: no public exploit artifacts exist, so the practical near-term risk is low, but the attack surface is real and the endpoint should be protected as if exploitable.

Impact Assessment

The business impact of CVE-2023-42249 is defined by the role of the affected product: Visual Access Manager administers access credentials and visit records. A successful XSS attack against an authenticated operator compromises the confidentiality of session data and the integrity of the administrative interface. Depending on how the deployment is wired, this may extend to the integrity of physical or logical access-control decisions, which raises the severity beyond a typical web-app XSS.

The absence of CVSS data (score N/A, vector N/A) prevents quantitative severity benchmarking. However, the EPSS score — 0.00233, placing the CVE at the 14.4th percentile of exploited CVEs — indicates a low probability of exploitation in the wild in the near term. The CVE is not present in CISA's Known Exploited Vulnerabilities catalog, confirming no observed in-the-wild exploitation as of the reporting date. Blast radius is contained to the VAM web application and its data store, but the consequences of access-control tampering can reach physical security domains depending on deployment architecture.

Detection Guidance

Detection of this CVE is limited by the absence of a public exploit signature. The rules below detect the general class of XSS probing/exploitation against the vam_visits.php endpoint and should be tuned to the organization's baseline before enablement in alerting mode.

Sigma Rule

title: Selesta Visual Access Manager XSS Attempt Against vam_visits.php
id: 7f3b9c1a-2e44-4d0a-9f0c-6a3b2c1d4e5f
status: experimental
description: Detects HTTP requests to vam_visits.php containing XSS payload indicators
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42249
author: Threat Intelligence - valtersit.com
date: 2025/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection_endpoint:
        cs-uri-path|contains|all:
            - 'vam'
            - 'vam_visits.php'
    selection_payload:
        cs-uri-query|contains|any:
            - '<script'
            - '<img'
            - 'javascript:'
            - 'onerror='
            - 'onload='
            - 'alert('
            - 'document.cookie'
            - '%3Cscript'
            - '%3Cimg'
            - 'vbscript:'
    filter_known_good:
        cs-uri-query|contains: 'enc=False'   # adjust to organization baseline
    condition: selection_endpoint and selection_payload and not filter_known_good
fields:
    - c-ip
    - c-uri
    - cs-user-agent
falsepositives:
    - Security scanners and automated vulnerability assessment tools
    - Legitimate administrative use containing literal XSS test strings
level: high

YARA Rule

rule CVE_2023_42249_Selesta_VAM_XSS
{
    meta:
        author = "Threat Intelligence - valtersit.com"
        description = "Detects XSS payloads targeting Selesta Visual Access Manager vam_visits.php"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-42249"
        cve = "CVE-2023-42249"
        date = "2025-01-01"
        severity = "high"
    strings:
        $endpoint = "vam_visits.php" ascii nocase
        $s_script = "<script" ascii nocase
        $s_img = "<img" ascii nocase
        $s_js = "javascript:" ascii nocase
        $s_onerr = "onerror=" ascii nocase
        $s_onload = "onload=" ascii nocase
        $s_alert = "alert(" ascii nocase
        $s_cookie = "document.cookie" ascii nocase
        $s_enc_script = "%3Cscript" ascii nocase
    condition:
        $endpoint and 2 of ($s_script, $s_img, $s_js, $s_onerr, $s_onload, $s_alert, $s_cookie, $s_enc_script)
}

Note: this rule is applicable to web-server access logs, proxy logs, or packet-capture payload extraction; URL-encoded variants such as %3C and %3E are only partially covered and should be scanned additionally in decoded form.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2023-42249 Selesta Visual Access Manager XSS Attempt Detection"; flow:established,to_server; http.uri; content:"vam_visits.php"; nocase; http.uri; content:"<script"; nocase; sid:202342249; rev:1; classtype:web-application-attack; reference:cve,2023-42249; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-42249;)

Tuning note: Suricata matches against the raw URI. Because attackers may URL-encode the payload (%3Cscript%3E), add additional signatures with content:"%3Cscript"; and content:"javascript:"; variants to improve coverage without excessively raising false positives.

Elastic Detection

any where http.request.uri : "*vam_visits.php*"
    and (
        http.request.uri : "*<script*"
        or http.request.uri : "*javascript:*"
        or http.request.uri : "*onerror=*"
        or http.request.uri : "*onload=*"
        or http.request.uri : "*alert(*"
        or http.request.uri : "*document.cookie*"
        or http.request.uri : "*%3Cscript*"
    )

This EQL query matches HTTP request URIs (and can be extended to http.request.body.content for POST-based stored XSS probes) targeting the vulnerable endpoint while carrying common script-delivery markers.

Splunk SPL Query

index=web sourcetype=access_combined uri_path="*vam_visits.php*"
| where uri_query LIKE "%<script%" OR uri_query LIKE "%javascript:%" 
    OR uri_query LIKE "%onerror=%" OR uri_query LIKE "%onload=%" 
    OR uri_query LIKE "%alert(%" OR uri_query LIKE "%document.cookie%" 
    OR uri_query LIKE "%%3Cscript%"
| table _time, src_ip, uri_path, uri_query, useragent, status
| sort - _time
| stats count by src_ip, uri_query

Replace index=web and sourcetype with the organization's actual web-log sourcetype. The query surfaces all requests to the vulnerable endpoint that contain XSS indicators and aggregates them by source IP to identify scanning or campaign behavior.

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="308711" level="12">
    <decoded>vam_visits.php</decoded>
    <match>vam_visits.php</match>
    <regex>(&lt;script|javascript:|onerror=|onload=|alert\(|document\.cookie)</regex>
    <description>CVE-2023-42249 Selesta Visual Access Manager XSS exploitation attempt detected</description>
    <group>web_application_attack,xss,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <references>
      <item>https://nvd.nist.gov/vuln/detail/CVE-2023-42249</item>
    </references>
  </rule>
</group>

Deploy this rule in the Wazuh manager's local ruleset (e.g., local_rules.xml) and ensure Apache/Nginx JSON or syslog logs from VAM front-end web servers are ingested into the analysis pipeline.

Mitigation & Patch Guidance

Patch confidence for CVE-2023-42249 is 0/4 — no patch evidence exists from any tracked source (no vendor advisory, commit, or changelog entry was identified). The NVD version qualifier suggests version 4.42.2 addresses the flaw, but this is not independently confirmed. Until verified, assume the product is unpatched.

1. Immediate mitigations:

• Restrict network access to the vam/ application path. Place Visual Access Manager behind a VPN, bastion host, or reverse proxy requiring multi-factor authentication, and block direct internet exposure.
• Deploy a WAF or reverse-proxy filtering rule that blocks requests to vam_visits.php containing <script, javascript:, onerror=, onload=, and their URL-encoded equivalents (%3Cscript, %26lt;script, etc.).
• Enforce browser-side protections for administrators: enable HttpOnly and Secure flags on session cookies; apply a Content-Security-Policy (CSP) header with script-src 'self' to limit the impact of an XSS bypass.
• Review existing web-server logs for requests to vam_visits.php containing script markers to detect prior probing.

2. Patch/upgrade steps:

• Contact Selesta or the reseller supporting the deployment to confirm whether version 4.42.2 (or later) contains an official fix, and obtain the vendor's changelog or advisory.
• If the fix is confirmed, upgrade Visual Access Manager to 4.42.2 or newer in a staging environment first, validate access-manager record integrity, then roll out to production.
• If the vendor cannot confirm a fix, treat the product as vulnerable indefinitely and rely exclusively on compensating controls.

3. Long-term hardening:

• Centralize web-server logs into the SIEM and continuously run the Sigma/Splunk/Wazuh detections listed above.
• Implement input validation and output encoding within any custom integrations that interface with the VAM application.
• Apply network segmentation so that access-management applications are isolated from general user segments, reducing the likelihood that a compromised operator workstation can reach the vulnerable endpoint.
• Subscribe to NVD and vendor security feeds for updates to this CVE; re-evaluate patch confidence quarterly.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-42249 (authoritative description: "Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via vam/vam_visits.php")
• MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42249
• FIRST EPSS Data: https://www.first.org/epss/api (EPSS score 0.00233, 14.4th percentile)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2023-42249 not listed as of this report)
• No vendor advisory, researcher blog, or threat-actor campaign documentation for this CVE was identified at the time of writing; no exploit-in-the-wild evidence exists in tracked sources.