CVE-2022-22114
📋 TL;DR
This is a reflected cross-site scripting (XSS) vulnerability in Teedy document management system that allows unauthenticated attackers to inject malicious scripts via search functionality. When victims (including administrators) click crafted URLs, session IDs can be stolen leading to full account takeover. Versions v1.5 through v1.9 are affected.
💻 Affected Systems
- Teedy (formerly Sismics Docs)
📦 What is this software?
Teedy by Sismics
⚠️ Risk & Real-World Impact
Worst Case
Administrator account takeover leading to complete system compromise, data theft, and potential ransomware deployment
Likely Case
Session hijacking of regular users leading to unauthorized document access and privilege escalation
If Mitigated
Limited impact with proper input validation and output encoding in place
🎯 Exploit Status
Simple reflected XSS requiring victim interaction; exploit code is publicly available in commit references
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.10 and later
Vendor Advisory: https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c
Restart Required: Yes
Instructions:
1. Backup your Teedy instance and database. 2. Download and install Teedy v1.10 or later from official repository. 3. Restart the Teedy service. 4. Verify the fix by testing search functionality with XSS payloads.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block XSS patterns in search parameters
# Example ModSecurity rule: SecRule ARGS:q "@rx <script>" "id:1001,phase:2,deny,msg:'XSS attempt in search parameter'"
Input Validation Proxy
linuxDeploy reverse proxy to sanitize search parameters before reaching Teedy
# nginx location block with parameter filtering
location /search {
proxy_pass http://teedy-backend;
set $q $arg_q;
if ($q ~* "[<>]") { return 403; }
}
🧯 If You Can't Patch
- Disable search functionality entirely if not critical for operations
- Implement Content Security Policy (CSP) headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Test search functionality with payload: <script>alert('XSS')</script> or <img src=x onerror=alert(1)>Check Version:
Check Teedy web interface footer or admin panel for version numberVerify Fix Applied:
After patching, test same XSS payloads - they should be properly encoded or blocked📡 Detection & Monitoring
Log Indicators:
- HTTP requests with script tags in query parameters
- Search queries containing HTML/JavaScript special characters
- Multiple failed search attempts with malicious patterns
Network Indicators:
- URLs with encoded script payloads in search parameters
- Requests to search endpoint with suspicious parameter lengths
SIEM Query:
source="teedy_access.log" AND (uri="*search*" AND (query="*<script>*" OR query="*javascript:*" OR query="*onerror=*"))🔗 References
- https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22114
- https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22114
