CVE-2023-42250

Executive Summary

CVE-2023-42250 is a Cross-Site Scripting (XSS) vulnerability in Selesta Visual Access Manager versions prior to 4.42.2, reachable through the /common/autocomplete.php endpoint. Organizations exposing the Visual Access Manager administrative web interface to untrusted networks or users are affected; the primary impact is execution of attacker-controlled script in the context of an authenticated user's browser session. No public exploit, CVSS vector, or vendor patch has been confirmed at the time of writing, and the low EPSS score (0.00233) indicates limited current exploitation likelihood.

Technical Analysis

The NVD description identifies a Cross-Site Scripting vulnerability in Selesta Visual Access Manager versions earlier than 4.42.2, located at the /common/autocomplete.php endpoint. The CNA title and NVD description provide no additional implementation-level detail — no parameter names, request methods, or code snippets are published. The following analysis is therefore based on the vulnerability class and the nature of the affected endpoint.

Autocomplete endpoints are a common source of reflected XSS. They typically accept a user-supplied search or filter term, process it server-side, and return matching suggestions to the browser. If the server does not validate and output-encode the submitted value before it is reflected in the generated HTML/JSON response, an attacker can inject script-oriented markup that the browser interprets in the origin of the application. Because the injected payload executes with the privileges of the victim's session, the impact surface includes the administrative functions of the Visual Access Manager.

The attack surface is a public-facing HTTP request to /common/autocomplete.php. The flaw class is insufficient output encoding (CWE-79: Improper Neutralization of Input During Web Page Generation). No authentication requirement can be confirmed from the available data; even if the endpoint requires an authenticated session, an attacker can leverage a victim's active session by delivering a crafted link (e.g., via phishing or a waterhole technique). Additional technical detail is not available from the NVD description or CNA title at this time.

Exploitation Scenarios

No public PoC or exploit code has been identified for CVE-2023-42250. The following attack chain is inferred strictly from the vulnerability class and the described endpoint, and should be validated by the reader against a live instance in a controlled lab environment:

1. Reconnaissance / target identification: The attacker identifies internet-facing or internal instances of Selesta Visual Access Manager. Shodan-style queries for the product name or a direct request to /common/autocomplete.php can confirm whether the vulnerable endpoint is present. Because no version banner is confirmed public, the attacker may fingerprint version via application behavior or other exposed static assets.

2. Triggering the flaw: The attacker crafts a request to /common/autocomplete.php that includes a malicious payload in the user-supplied parameter consumed by the autocomplete functionality. The exact parameter name is not published; at the vulnerability-class level, any unencoded parameter reflected into the response can serve as the injection point. The payload may include <script> tags, javascript: URIs, or event handler attributes (onerror, onload, etc.).

3. Execution: The attacker delivers the crafted URL — or a shortened/redirected variant — to a victim who has an active session in the Visual Access Manager. The victim's browser submits the request; the application reflects the payload without proper sanitization; the script executes in the application's origin. If the endpoint is reachable unauthenticated, execution still occurs in the context of whatever session the browser presents.

4. Post-exploitation: With script execution inside the application origin, the attacker can read session cookies, make authenticated requests on behalf of the victim, exfiltrate data displayed by the application, or capture credentials through a phishing overlay. In an access-management console, this can lead to modification of access-control rules, user account compromise, and lateral movement within the physical/logical access management infrastructure the product controls.

Impact Assessment

• Business impact: Selesta Visual Access Manager is a web-based access management application. Compromise of its administrative context can enable an attacker to alter physical/IT access policies, disable or grant user entitlements, harvest credential material, and destroy audit log integrity. The XSS is executed in the victim's browser, so the direct technical impact is confidentiality and integrity of the victim's session and all functions available to that session.

• Affected systems: All deployments running Visual Access Manager versions prior to 4.42.2. The exact list of affected versions is not enumerated in the NVD feed; the vulnerable boundary is defined only by the < 4.42.2 constraint.

• Blast radius: Because the provided CVSS score is N/A, no quantitative severity baseline is available; prioritization must be based on the application's role in the environment. The EPSS score (0.00233, 14.4th percentile) indicates that exploitation in the wild is currently uncommon and not part of any tracked mass-exploitation wave. CISA KEV does not list this CVE. Nevertheless, for an administrative control-plane application, even a single successful phish can lead to organizational-level impact.

Detection Guidance

The following detection content targets web-server logs and HTTP traffic indicative of XSS attempts against /common/autocomplete.php. Adjust field names and log sources to match your environment.

Sigma Rule

title: XSS Attempt Against Selesta Visual Access Manager autocomplete.php
id: 9f1a4d87-2023-4225-8a7d-11c4a4a42250
status: experimental
description: Detects reflection of XSS payloads in requests to /common/autocomplete.php
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2023-42250
logsource:
  category: webserver
  product: apache
  definition: 'Adjust product to match web server logs'
detection:
  selection_path:
    cs-uri-path|contains: '/common/autocomplete.php'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'alert('
  condition: selection_path and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
  - sc-status
falsepositives:
  - Legitimate security scanners
  - Applications that intentionally pass payload-like values to autocomplete filters
level: high

YARA Rule

rule Selesta_VAM_XSS_autocomplete {
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Hunting rule for XSS payloads targeting CVE-2023-42250 in web logs or response captures"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-42250"
        date = "2025-04-25"
    strings:
        $endpoint = "/common/autocomplete.php"
        $s1 = "<script" ascii nocase
        $s2 = "javascript:" ascii nocase
        $s3 = "onerror=" ascii nocase
        $s4 = "onload=" ascii nocase
        $s5 = "alert(" ascii nocase
        $s6 = "document.cookie" ascii nocase
    condition:
        $endpoint and 2 of ($s1, $s2, $s3, $s4, $s5, $s6)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS Selesta Visual Access Manager autocomplete.php XSS Attempt"; flow:established,to_server; http.uri; content:"/common/autocomplete.php"; pcre:"/(<script|javascript:|onerror=|onload=|alert\()/i"; classtype:web-application-attack; reference:cve,2023-42250; sid:202342250; rev:1;)

Elastic Detection

any where url.path == "/common/autocomplete.php" and (
  wildcard(url.query, "*<script*") or
  wildcard(url.query, "*javascript:*") or
  wildcard(url.query, "*onerror=*") or
  wildcard(url.query, "*onload=*") or
  wildcard(url.query, "*alert(*")
)

Splunk SPL Query

index=web* sourcetype=access_combined uri_path="/common/autocomplete.php"
| where match(uri_query, "(?i)(<script|javascript:|onerror=|onload=|alert\\()")
| table _time src_ip uri uri_query user_agent sc_status
| sort - _time

Wazuh OSSEC Rule

<rule id="602092" level="10">
  <match>autocomplete.php</match>
  <regex>(&lt;script|javascript:|onerror=|onload=|alert\()</regex>
  <description>CVE-2023-42250: Possible XSS attempt against Selesta Visual Access Manager autocomplete endpoint</description>
  <group>web_application_attack,xss,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence exists from any tracked source, and no vendor advisory, commit, or fixed-release notification has been observed. The NVD description states the vulnerability affects versions prior to 4.42.2, implying that version 4.42.2 or later is the intended fixed line; however, this could not be independently verified.

Immediate mitigations:

• Deploy a WAF or reverse-proxy rule that inspects requests to /common/autocomplete.php and blocks or sanitizes query parameters containing common XSS signatures (<script, javascript:, on*= event handlers, alert(, document.cookie).
• Restrict network access to the Visual Access Manager console to trusted administrative networks only; place it behind a VPN or jump host.
• If the autocomplete endpoint is not required, disable it at the application or proxy layer.
• Ensure session cookies are set with HttpOnly and Secure attributes to blunt cookie-theft impact, and enable a strict Content-Security-Policy (CSP) on the application to limit script execution.

Patch/upgrade steps:

• Contact Selesta or review the official vendor release channel to determine whether version 4.42.2 or a later hotfix is available for download.
• Plan a controlled upgrade of all Visual Access Manager installations to the newest available version, testing in a staging environment that mirrors production access-control integration.
• Re-audit after upgrade by requesting /common/autocomplete.php with benign XSS-probe payloads and verifying they are encoded or rejected.

Long-term hardening:

• Adopt a formal input-validation and output-encoding standard for all application endpoints; all reflected data must be contextually encoded (HTML, attribute, and JavaScript contexts).
• Implement a software asset inventory that tracks the exact Visual Access Manager version on every host, tied to a recurring patch-intake process.
• Monitor CISA KEV and vendor advisories for updates to this CVE, as patch status and exploitation activity may change.
• Enforce least-privilege accounts for the administrative console and enable audit logging of all administrative actions.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-42250
• CVE.org Record: https://cve.org/CVERecord?id=CVE-2023-42250
• MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2023-42250 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No vendor advisory, researcher analysis, or threat-actor campaign referencing CVE-2023-42250 was identified during research. No exploit-in-the-wild evidence is currently known; the EPSS score of 0.00233 reflects a low but non-zero probability of exploitation.