Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in causefx/organizr

The impact of CVE-2022-1347 is severe due to the potential for complete account takeover. An attacker exploiting this vulnerability can inject arbitrary JavaScript code into the application, which will then be executed in the context of a user's browser when they view the affected page. Specifically, the vulnerability targets administrator and co-administrator accounts, granting an attacker full control over the Organizr instance. This could allow them to modify organizational charts, access sensitive data, and potentially compromise other systems connected to the Organizr server. The ease of exploitation, combined with the high privileges at risk, makes this a significant threat.

Organizations using self-hosted instances of Organizr, particularly those with administrator or co-administrator accounts that are not adequately protected by multi-factor authentication, are at significant risk. Shared hosting environments where multiple users share the same server and database are also particularly vulnerable, as a compromise of one user could potentially lead to the compromise of others.

• php / web:

curl -I 'http://your-organizr-instance/admin/users/create?username=<script>alert(1)</script>' | grep -i 'content-type'

• generic web:

curl -I 'http://your-organizr-instance/admin/users/create?username=<script>alert(1)</script>' | grep -i 'set-cookie'

• generic web:

 grep -r '<script>' /var/www/html/organizr/*

1. 2022-04-13Disclosure

   disclosure

2. 2022-04-13Patch

   patch

1. Gereserveerd2022-04-13
2. Gepubliceerd2022-04-13
3. Gewijzigd2024-08-03
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2022-1347 is to upgrade Organizr to version 2.1.1810 or later, which contains the fix for this vulnerability. If upgrading immediately is not possible, consider implementing input validation and sanitization on the "Username" and "Email" fields to prevent the injection of malicious scripts. While not a complete solution, a Web Application Firewall (WAF) configured to block XSS payloads targeting these fields can provide an additional layer of defense. After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into the "Username" or "Email" fields and confirming that the script is not executed.