Plateforme
php
Composant
snipe/snipe-it
Corrigé dans
v5.4.3
CVE-2022-1380 is a critical stored Cross-Site Scripting (XSS) vulnerability affecting Snipe-IT versions up to and including v5.4.3. This vulnerability allows attackers to inject malicious scripts through the Item name parameter, potentially leading to cookie theft and account compromise. The vulnerability was published on April 16, 2022, and a patch is available in version v5.4.3.
The primary impact of CVE-2022-1380 is the potential for attackers to steal user cookies. Successful exploitation allows an attacker to impersonate a legitimate user, gaining unauthorized access to sensitive data and performing actions on behalf of the victim. This could include modifying asset records, accessing financial information, or even gaining administrative control of the Snipe-IT instance. The stored nature of the XSS means that the malicious script persists on the server, potentially affecting multiple users over time. This vulnerability shares similarities with other XSS attacks where cookie theft is a primary goal, enabling session hijacking and further compromise.
CVE-2022-1380 is a publicly known vulnerability with a high CVSS score. Public proof-of-concept exploits are likely to emerge, increasing the risk of exploitation. While no confirmed active exploitation campaigns have been publicly reported as of this writing, the ease of exploitation and the potential impact make it a high-priority vulnerability. The vulnerability was disclosed on April 16, 2022.
Organizations utilizing Snipe-IT for asset tracking, particularly those running versions prior to v5.4.3, are at risk. This includes businesses of all sizes, educational institutions, and any entity relying on Snipe-IT for managing IT assets. Shared hosting environments where Snipe-IT is installed are particularly vulnerable due to the potential for cross-tenant exploitation.
• php / server:
find /var/www/snipe-it -name '*.php' -print0 | xargs -0 grep -i 'item name parameter'• generic web:
curl -I <snipe-it-url>/items/new | grep -i 'set-cookie'disclosure
patch
Statut de l'Exploit
EPSS
0.25% (percentile 48%)
Vecteur CVSS
The primary mitigation for CVE-2022-1380 is to immediately upgrade Snipe-IT to version v5.4.3 or later. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the Item name parameter to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Monitor Snipe-IT logs for suspicious activity, particularly unusual script execution or attempts to access sensitive data.
Actualice Snipe-IT a la versión 5.4.3 o superior. Esta versión contiene la corrección para la vulnerabilidad XSS almacenada. Puede descargar la última versión desde el sitio web oficial o el repositorio de GitHub.
Analyses de vulnérabilités et alertes critiques directement dans votre boîte mail.
CVE-2022-1380 is a critical stored XSS vulnerability in Snipe-IT versions up to v5.4.3, allowing attackers to inject malicious scripts through the Item name parameter.
Yes, if you are running Snipe-IT versions prior to v5.4.3, you are vulnerable to this XSS attack. Upgrade immediately.
Upgrade Snipe-IT to version v5.4.3 or later. Implement input validation and sanitization as a temporary workaround if upgrading is not immediately possible.
While no confirmed active exploitation campaigns have been publicly reported, the vulnerability's severity and ease of exploitation suggest a high risk of future attacks.
Refer to the Snipe-IT security advisory on their GitHub repository: https://github.com/snipe/snipe-it/security/advisories/GHSA-5p7g-x49w-999c
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.