CVE-2022-30280
📋 TL;DR
This CSRF vulnerability in Nokia NetAct allows attackers to create users with arbitrary privileges, including administrative accounts, by tricking authenticated users into visiting malicious web pages. It affects Nokia NetAct version 22 installations with the SecurityManagement module exposed. Both internet-facing and internal deployments are at risk.
💻 Affected Systems
- Nokia NetAct
📦 What is this software?
Netact by Nokia
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the NetAct system through creation of administrative accounts, leading to unauthorized access, data exfiltration, and potential lateral movement to connected telecom infrastructure.
Likely Case
Attackers create backdoor administrative accounts through phishing campaigns targeting NetAct administrators, leading to persistent unauthorized access.
If Mitigated
With proper CSRF protections and network segmentation, impact is limited to isolated administrative interfaces with no critical data exposure.
🎯 Exploit Status
Exploitation requires victim to be authenticated and visit malicious page. Simple HTML/JavaScript payload can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in references - check Nokia security advisories
Vendor Advisory: Not provided in CVE references
Restart Required: Yes
Instructions:
1. Contact Nokia support for security patches. 2. Apply patch following Nokia's deployment procedures. 3. Restart NetAct services as required. 4. Verify CSRF protection is implemented in createuser.jsf endpoint.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF token validation to /SecurityManagement/html/createuser.jsf endpoint
Requires code modification - consult Nokia documentation for CSRF implementation
Network Segmentation
linuxRestrict access to NetAct web interface to trusted networks only
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="TRUSTED_NETWORK" port port="443" protocol="tcp" accept'
iptables -A INPUT -s TRUSTED_NETWORK -p tcp --dport 443 -j ACCEPT
🧯 If You Can't Patch
- Implement strict network access controls to limit NetAct web interface access to administrative VLANs only
- Deploy web application firewall with CSRF protection rules and monitor for suspicious user creation attempts
🔍 How to Verify
Check if Vulnerable:
Test /SecurityManagement/html/createuser.jsf endpoint for CSRF token validation by attempting POST requests without valid tokensCheck Version:
Check NetAct version through web interface or consult Nokia documentation for version checking proceduresVerify Fix Applied:
Verify that POST requests to createuser.jsf without valid CSRF tokens are rejected with appropriate error responses📡 Detection & Monitoring
Log Indicators:
- Multiple user creation events from same IP/session
- User creation with administrative privileges from non-standard locations
- Failed CSRF token validation attempts
Network Indicators:
- HTTP POST requests to createuser.jsf without Referer headers
- Requests with suspicious user agent strings or from unexpected geolocations
SIEM Query:
source="netact_logs" AND (event_type="user_creation" AND privilege_level="admin") | stats count by src_ip, user_agent