Teedy - Stored Cross-Site Scripting (XSS) in Tag Name

The XSS vulnerability in Teedy allows attackers to inject arbitrary JavaScript code into the Tag name field. This code is then executed in the context of any user who views the Tag, including administrators. Successful exploitation can lead to session hijacking, allowing the attacker to impersonate the administrator and gain full control of the system. The impact is particularly severe because the attacker does not need to authenticate as an administrator to inject the malicious script; only the ability to create a Tag is required. This could lead to data breaches, system compromise, and further lateral movement within the network.

Organizations using Teedy for tag management, particularly those with administrator accounts that frequently interact with the system, are at risk. Shared hosting environments where multiple users share the same Teedy instance are also particularly vulnerable, as an attacker could potentially compromise the entire hosting environment through this vulnerability.

• generic web:

curl -I <teedy_url>/edit_tag.php?tag_name='<script>alert(1)</script>

• generic web:

grep -r '<script>' /var/log/apache2/access.log

• generic web:

grep -r 'alert(' /var/log/apache2/error.log

1. 2022-01-10Disclosure

   disclosure

1. 予約済み2021-12-21
2. 公開日2022-01-10
3. 更新日2024-09-17
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2022-22115 is to upgrade Teedy to a patched version. If upgrading immediately is not possible, consider implementing input validation and output encoding on the Tag name field to sanitize user-supplied data. While not a complete solution, this can reduce the risk of successful exploitation. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide an additional layer of protection. Regularly review Teedy configurations to ensure proper security settings are in place.