CVE-2022-31456

Vulnerability

A cross-site scripting (XSS) vulnerability exists in Truedesk v1.2.2. The application fails to properly sanitize user input provided through the team name parameter. An attacker can inject arbitrary HTML or JavaScript payloads into this parameter, which are then stored and executed when other users view the affected page. The vulnerability is classified as stored XSS, as the crafted payload persists in the system and affects any user accessing the compromised team name context.

Exploitation

An attacker must have network access to the Truedesk instance and the ability to submit a team creation or update request. No special authentication is required beyond regular user privileges that allow team management. The attacker crafts a payload containing malicious HTML or JavaScript (e.g., ``) and submits it as the team name parameter. The payload is stored server-side. Whenever a victim (including administrators) navigates to a page that displays the team name, the malicious script executes in their browser context.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim’s session. This can lead to session hijacking, credential theft, defacement, redirection to malicious sites, or further actions within the Truedesk application under the victim’s privileges. The impact is elevated if the victim has administrative rights, as the attacker may perform privileged operations on their behalf.

Mitigation

As of the publication date (2023-07-26) and per the available references [1], no specific patch for Truedesk v1.2.2 is mentioned. General XSS remediation advice from the reference [1] includes applying context-dependent encoding and validation to all user input rendered on output pages. Administrators should upgrade to the latest version of Truedesk when a fix is released. If an immediate update is not possible, input validation and output encoding should be implemented using a security-focused library. The CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog.