In the free open-source online project management application Rukovoditel v3.2.1, a stored Cross-Site Scripting (XSS) vulnerability has been discovered. This vulnerability, labeled CVE-2022-43170, affects the Dashboard Configuration feature in the application. Authenticated attackers can exploit this vulnerability to execute arbitrary web scripts or HTML code by injecting a crafted payload into the Title parameter of the "Add info block" in the Dashboard Configuration interface (index.php?module=dashboard_configure/index).

Description

Stored XSS vulnerabilities occur when untrusted user input is not properly sanitized and is stored on a web application's server. Whenever the stored input is retrieved and displayed to users, the malicious payload, such as an arbitrary script or HTML code, will be executed within the user's browser.

In the case of CVE-2022-43170, the vulnerable endpoint is the Dashboard Configuration feature in Rukovoditel. Authenticated users can create and manage info blocks on their dashboard. The vulnerability is in the Title parameter, which allows attackers to inject a crafted payload into the info block.

Code Snippet

To demonstrate the vulnerability, an authenticated attacker can input the following payload into the Title field of the "Add info block" form:

<script>alert('XSS');</script>

In this example, when the user submits the form, the payload is stored, and any user opening the dashboard with the malicious info block will see an alert box with the text "XSS." This demonstrates that the user-supplied input was not adequately sanitized and the application is vulnerable to stored XSS attacks.

Exploit Details

An attacker can take advantage of CVE-2022-43170 by crafting malicious payloads that can perform various web-based attacks on the user's browser, such as:

Original references

Rukovoditel developers have been made aware of the vulnerability, and they have released a patch to fix it. Users are encouraged to update their Rukovoditel installations to the latest version to protect against this stored XSS vulnerability.

1. Rukovoditel official website: https://www.rukovoditel.net/
2. Rukovoditel GitHub repository: https://github.com/rkcons/configure

CVE-2022-43170 vulnerability references

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43170
  - https://nvd.nist.gov/vuln/detail/CVE-2022-43170

Mitigation

Users and administrators of Rukovoditel v3.2.1 should immediately update their installations to the latest version that includes the security patch for the CVE-2022-43170 vulnerability. Additionally, they should also consider implementing further security measures, such as enabling Content Security Policy, to further protect their application against cross-site scripting attacks.

Closing Remarks

Stored Cross-Site Scripting vulnerabilities can lead to serious security issues for web applications. It is essential for developers to rigorously sanitize user-supplied data and for users to keep their software up-to-date to minimize exposure to these kinds of threats.

Timeline

Published on: 10/28/2022 17:15:00 UTC
Last modified on: 11/01/2022 12:47:00 UTC