PT-2022-22113 · Yii2 Gii · Yii2 Gii

Boris Kovalkov · Published 2022-12-09 · Updated 2022-12-13 · CVE-2022-34297

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Yii2 Gii versions through 2.2.4

Description The issue allows stored XSS by injecting a payload into any field. Some fields, such as Message Category in Model Generator, CRUD Generator or Form Generator, and Author Name in Extension Generator, are being cached without sanitization of their contents when the Preview button is pressed. This leads to the possibility of injecting malicious JavaScript in specified pages by placing it in said fields and caching it by pressing the Preview button. On each consequent visit of specified pages, malicious JavaScript will be loaded from the server and executed in the client's browser.

Recommendations For versions through 2.2.4, as a temporary workaround, consider disabling the Preview button functionality in the affected generators until a patch is available. Restrict access to the caching mechanism for the specified fields to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-34297

GHSA-X87M-36G7-6MPW

Affected Products

Yii2 Gii

References · 7

• 🔥 https://gist.github.com/be4r/b5c48d97ef6726d3ee37f995ee5aac81 · Exploit
• https://osv.dev/vulnerability/CVE-2022-34297 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34297 · Security Note
• https://osv.dev/vulnerability/GHSA-x87m-36g7-6mpw · Vendor Advisory
• https://github.com/yiisoft/yii2-gii · Note
• https://yiiframework.com/doc/guide/2.0/en/start-gii · Note
• https://t.me/cibsecurity/54249 · Telegram Post