Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it

The primary impact of CVE-2022-1380 is the potential for attackers to steal user cookies. Successful exploitation allows an attacker to impersonate a legitimate user, gaining unauthorized access to sensitive data and performing actions on behalf of the victim. This could include modifying asset records, accessing financial information, or even gaining administrative control of the Snipe-IT instance. The stored nature of the XSS means that the malicious script persists on the server, potentially affecting multiple users over time. This vulnerability shares similarities with other XSS attacks where cookie theft is a primary goal, enabling session hijacking and further compromise.

Organizations utilizing Snipe-IT for asset tracking, particularly those running versions prior to v5.4.3, are at risk. This includes businesses of all sizes, educational institutions, and any entity relying on Snipe-IT for managing IT assets. Shared hosting environments where Snipe-IT is installed are particularly vulnerable due to the potential for cross-tenant exploitation.

• php / server:

find /var/www/snipe-it -name '*.php' -print0 | xargs -0 grep -i 'item name parameter'

• generic web:

curl -I <snipe-it-url>/items/new | grep -i 'set-cookie'

1. 2022-04-16Disclosure

   disclosure

2. 2022-04-16Patch

   patch

最后更新

8.5.0最近

1. 已保留2022-04-15
2. 发布日期2022-04-16
3. 修改日期2024-08-03
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2022-1380 is to immediately upgrade Snipe-IT to version v5.4.3 or later. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the Item name parameter to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Monitor Snipe-IT logs for suspicious activity, particularly unusual script execution or attempts to access sensitive data.