Stored XSS in "Name", "Group Name" & "Title" in polonel/trudesk

The impact of this XSS vulnerability is significant. An attacker can inject arbitrary JavaScript code into the Trudesk application, which will then be executed in the context of any user who views the affected page. This can lead to a variety of malicious actions, including session hijacking, where the attacker gains control of a user's account. Sensitive data, such as user credentials or personal information, could be stolen. Furthermore, the attacker could deface the application or redirect users to malicious websites. The ease of exploitation, combined with the potential for widespread impact, makes this a high-priority vulnerability.

Organizations using Trudesk in production environments, particularly those with publicly accessible instances, are at risk. Shared hosting environments where multiple users share the same server instance are also particularly vulnerable, as an attacker could potentially compromise other users through this vulnerability.

• nodejs / server:

find /var/www/trudesk -type f -name '*.js' -print0 | xargs -0 grep -i 'document.location' || grep -i 'eval(' || grep -i 'new Function('

• generic web:

curl -I <trudesk_url>/<affected_page>

Inspect the response headers for unusual content or unexpected scripting tags. • generic web:

curl <trudesk_url>/<affected_page>?Name=<script>alert(1)</script>

Observe the browser's JavaScript console for any errors or unexpected behavior.

1. 2022-04-10Disclosure

   disclosure

2. 2022-04-10Patch

   patch

1. 已保留2022-04-10
2. 发布日期2022-04-10
3. 修改日期2024-08-02
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2022-1290 is to immediately upgrade Trudesk to version 1.2.0 or later. This version contains a fix that prevents the injection of malicious scripts. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the "Name", "Group Name", and "Title" fields to prevent the injection of potentially harmful characters. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. After upgrading, confirm the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into the affected fields and verifying that the script is not executed.