Possible XSS attack via translation

The primary impact of CVE-2022-0475 is the potential for arbitrary JavaScript execution within the OTRS Package manager. A successful exploit could allow an attacker to steal sensitive data, modify system configurations, or even gain control of the OTRS instance. Given that OTRS is often used for customer service and support, this could expose customer data, internal communications, and other confidential information. The ability to execute code within the Package manager significantly expands the attack surface, potentially allowing for persistent backdoors or further exploitation of the system. While the CVSS score is LOW, the potential for data compromise and system manipulation warrants immediate attention.

Organizations using OTRS for customer service and support are at risk, particularly those relying on translator functionality for multilingual support. Legacy OTRS deployments running versions 7.0.x (≤7.0.32) and 8.0.x (≤8.0.19) are especially vulnerable. Shared hosting environments where multiple OTRS instances share resources could also be affected if one instance is compromised.

• otrs: Examine OTRS logs for unusual JavaScript execution patterns within the Package manager. Look for POST requests containing suspicious HTML or JavaScript code.

 grep -i 'javascript' /var/log/otrs/log.txt

• generic web: Monitor access logs for requests containing HTML or JavaScript code in translatable string fields. Use a WAF to detect and block suspicious requests.

 grep -i '<script' /var/log/apache2/access.log

• generic web: Check response headers for signs of XSS, such as the presence of X-XSS-Protection header (if not enabled, enable it).

 curl -I https://your-otrs-instance.com | grep X-XSS-Protection

1. 2022-03-21Disclosure

   disclosure

1. 予約済み2022-02-02
2. 公開日2022-03-21
3. 更新日2024-09-17
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2022-0475 is to upgrade to a patched version of OTRS. OTRS AG has released updates to address this vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. Review and restrict the ability for translators to inject HTML into translatable strings. Implement strict input validation and output encoding to sanitize user-supplied data. Consider using a Web Application Firewall (WAF) to filter out malicious JavaScript payloads. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into a translatable string and verifying that it is not executed.