CVE-2022-43754

Cross-site Scripting in SUSE Manager (4.2, 4.3)

• CVSS 5.4
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• Configuration Issues
• Remote

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.

CVE

CVE-2022-43754

CWE

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS base score

5.4

Published

2022-11-10

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Configuration Issues

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update SUSE Manager components to the specified versions.

from flask import Flask, request, render_template_string

app = Flask(__name__)

@app.route('/rhn/audit/scap/Search.do', methods=['GET', 'POST'])
def search():
    user_input = request.form.get('query', '')

    response = render_template_string('<h1>Search Results for: {}</h1>'.format(user_input))
    return response

if __name__ == '__main__':
    app.run()

from flask import Flask, request, escape, render_template_string

app = Flask(__name__)

@app.route('/rhn/audit/scap/Search.do', methods=['GET', 'POST'])
def search():
    user_input = request.form.get('query', '')

    escaped_input = escape(user_input)

    response = render_template_string('<h1>Search Results for: {{ query }}</h1>', query=escaped_input)
    return response

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202243754,
  title        = {{Cross-site Scripting in SUSE Manager (4.2, 4.3)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-43754},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-43754/}}
}