PT-2022-17699 · Cherwell · Cherwell Service Management

L00Neyhacker · Published 2022-02-28 · Updated 2022-03-08 · CVE-2022-26156

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cherwell Service Management (CSM) version 10.2.3

Description An issue was discovered in the web application where injection of a malicious payload within the RelayState= parameter of the HTTP request body results in the hijacking of the form action. This occurs when the application places user-supplied input into the action URL of an HTML form. An attacker can use this to construct a URL that, if visited by another application user, will modify the action URL of a form to point to the attacker's server.

Recommendations For Cherwell Service Management (CSM) version 10.2.3, as a temporary workaround, consider restricting the use of the RelayState= parameter in the HTTP request body until a patch is available. Avoid using the RelayState= parameter in the affected HTTP request body to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-26156

Affected Products

Cherwell Service Management

References · 6

• 🔥 https://github.com/l00neyhacker/CVE-2022-26156 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-26156 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26156 · Vendor Advisory
• https://help.cherwell.com/bundle/release_notes_10_4_help_only/page/content/release_notes/10_4_0_fix_list.html · Vendor Advisory
• https://t.me/cibsecurity/38178 · Telegram Post
• https://t.me/cvenotify/27907 · Telegram Post