CVE-2022-4966

Vulnerability

CVE-2022-4966 is a cross-site scripting (XSS) vulnerability in the Election Description Handler of Sequentech admin-console versions prior to 7.0.0-beta.1. The application used AngularJS's ng-bind-html directive to render election descriptions without proper sanitization, allowing malicious HTML or JavaScript to be executed when the description is viewed [1][2]. The root cause is that the $sanitize service was not consistently applied, and the backend did not sanitize input before displaying it [1].

Exploitation

An attacker with privileges to create or edit an election (typically an admin user) can inject a malicious payload into the election description field. This payload is stored and later rendered to other users, including administrators viewing the election list or creation screen [1][2]. The attack is launched remotely, requiring no direct network access beyond the application's interface [description].

Impact

Successful exploitation allows arbitrary JavaScript execution in the victim's browser, potentially leading to session hijacking, defacement, or redirection to malicious sites. The CVSS score of 3.5 (Low) reflects the requirement of administrative privileges and the limited scope of the application's use.

Mitigation

The vulnerability is patched in version 7.0.0-beta.1 [4]. The fix replaces ng-bind-html with ng-bind (which escapes HTML) and applies $sanitize more broadly to server responses [1][2]. The specific commit is 0043a6b1e6e0f5abc9557e73f9ffc524fc5d609d [2]. Users should upgrade to the latest release.