PT-2022-16016 · Unknown · Daloradius

Lirantal · Published 2022-12-06 · Updated 2022-12-12 · CVE-2022-23475

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions daloRADIUS versions 1.3 and prior

Description daloRADIUS is an open source RADIUS web management application. It is vulnerable to a combination of cross site scripting (XSS) and cross site request forgery (CSRF) vulnerabilities, which can lead to account takeover in the mng-del.php file due to an unescaped variable reflected in the DOM on line 116.

Recommendations For daloRADIUS versions 1.3 and prior, users are advised to manually apply the commit ec3b4a419e to mitigate this issue. As a temporary workaround, consider mitigating the CSRF vulnerability by making the daloRADIUS session cookie samesite=Lax or by implementing a CSRF token in all forms. Additionally, the XSS vulnerability may be mitigated by escaping it or by introducing a Content-Security policy.

Exploit

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2022-23475

GHSA-C9XX-6MVW-9V84

Affected Products

Daloradius

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23475.json · Exploit
• 🔥 https://github.com/lirantal/daloradius/security/advisories/GHSA-c9xx-6mvw-9v84 · Exploit
• https://github.com/lirantal/daloradius/commit/ec3b4a419e20540cf28ce60e48998b893e3f1dea · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23475 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23475 · Vendor Advisory
• https://github.com/zcgonvh/DCOMPotato · Note
• https://github.com/0xuf/DJRCE · Note
• https://t.me/pentestingnews/30984 · Telegram Post
• https://t.me/cibsecurity/54098 · Telegram Post
• https://t.me/cybersecuritytechnologies/7333 · Telegram Post