CVE-2022-40047

Vulnerability

Flatpress v1.2.1 is affected by a reflected cross-site scripting (XSS) vulnerability in the page parameter of /flatpress/admin.php. The application fails to sanitize or encode user input in the page parameter before reflecting it in the response, enabling an attacker to inject arbitrary JavaScript. The vulnerable code path is reachable via the admin panel without any special configuration beyond a valid login session [1].

Exploitation

An attacker with network access to the Flatpress instance can craft a malicious URL containing a JavaScript payload in the page parameter. The victim must be logged into the Flatpress admin panel and tricked into clicking the crafted link. For example, the payload %22onfocus%3d%22alert%28document.cookie%29%22autofocus%3d%22zr4da injected into the page parameter executes JavaScript (e.g., alert(document.cookie)) when the page is loaded [1]. No additional privileges or write access are required beyond the victim's existing session.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to theft of session cookies, enabling session hijacking and unauthorized access to the victim's account. The attacker may then view or alter blog content and administrative settings, compromising the confidentiality and integrity of the application [1].

Mitigation

The Flatpress project has not released a patched version. As of the publication date, no fix has been provided, and the issue remains open [1]. Mitigation strategies include: filtering and encoding the page parameter on input and output, restricting admin panel access to trusted users, and using browser security features such as Content Security Policy (CSP). It is recommended to monitor the Flatpress repository for an update and apply input sanitization as a workaround.