CVE-2022-50802
📋 TL;DR
ETAP Safety Manager 1.0.0.32 contains an unauthenticated reflected cross-site scripting vulnerability in the 'action' GET parameter. Attackers can craft malicious URLs that execute arbitrary JavaScript in victim browsers when visited, potentially stealing session cookies or performing unauthorized actions. This affects all users accessing vulnerable ETAP Safety Manager instances.
💻 Affected Systems
- ETAP Safety Manager
📦 What is this software?
Etap Safety Manager by Etaplighting
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, gain full control of the safety management system, manipulate safety-critical data, or redirect users to malicious sites.
Likely Case
Session hijacking, credential theft from users who click malicious links, or defacement of the application interface.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though some risk remains from social engineering attacks.
🎯 Exploit Status
Exploitation requires victims to click malicious links but requires no authentication to the target system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.etaplighting.com/
Restart Required: No
Instructions:
Contact ETAP Lighting for patch availability. If unavailable, implement workarounds immediately.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block malicious 'action' parameter values containing script tags or JavaScript.
Input Validation Filter
allImplement server-side validation to sanitize the 'action' parameter before processing.
🧯 If You Can't Patch
- Isolate the ETAP Safety Manager system from internet access and restrict to internal network only.
- Implement strict user awareness training about not clicking untrusted links to the application.
🔍 How to Verify
Check if Vulnerable:
Test by accessing the application with a crafted URL containing a harmless payload like: http://target/etap/?action=<script>alert('test')</script>Check Version:
Check the application interface or installation directory for version information (typically 1.0.0.32).Verify Fix Applied:
Verify the fix by testing the same payload and confirming it does not execute in the browser.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with suspicious 'action' parameter values containing script tags or JavaScript code
Network Indicators:
- Unusual GET requests to the ETAP Safety Manager with encoded script payloads in parameters
SIEM Query:
source="web_logs" AND uri="*etap*" AND query="*action=*script*"🔗 References
- https://cxsecurity.com/issue/WLB-2022090031
- https://exchange.xforce.ibmcloud.com/vulnerabilities/235743
- https://packetstormsecurity.com/files/168339/
- https://www.etaplighting.com/
- https://www.vulncheck.com/advisories/etap-safety-manager-unauthenticated-reflected-cross-site-scripting-via-action-parameter
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php
- https://cxsecurity.com/issue/WLB-2022090031
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php
