CVE-2022-27107 in OrangeHRM
Summary
by MITRE • 04/06/2022
OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" parameter
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/08/2022
The vulnerability identified as CVE-2022-27107 affects OrangeHRM version 4.10 and represents a critical stored cross-site scripting flaw within the OrangeBuzz functionality of the application. This security weakness specifically manifests in the "Share Video" section where user input is not properly sanitized or validated before being stored in the application's database and subsequently rendered to other users. The vulnerability occurs through the GET/POST parameter named "createVideo[linkAddress]" which accepts external input that can contain malicious script code. When another user accesses the video sharing section, the stored malicious script executes in their browser context, potentially compromising their session and system integrity.
The technical implementation of this vulnerability stems from inadequate input validation and output encoding practices within the OrangeHRM application's video sharing module. The application fails to properly sanitize user-supplied URLs or link addresses before persisting them to the database, creating a persistent vector for cross-site scripting attacks. This flaw allows attackers to inject malicious JavaScript code through the "linkAddress" parameter, which then gets executed whenever other users view the shared video content. The stored nature of this vulnerability means that the malicious payload remains active even after the initial injection, making it particularly dangerous as it can affect multiple users over an extended period without requiring repeated exploitation attempts.
The operational impact of CVE-2022-27107 extends beyond simple script execution, potentially enabling attackers to perform session hijacking, credential theft, data exfiltration, and privilege escalation within the OrangeHRM environment. An attacker could craft malicious video links that redirect users to phishing pages, steal session cookies, or inject additional malicious content that could compromise the entire application. The vulnerability affects all users who can access the OrangeBuzz video sharing functionality, potentially including employees, managers, and system administrators who may have elevated privileges. This creates a significant risk for organizations that rely on OrangeHRM for human resources management, as compromised user sessions could lead to unauthorized access to sensitive employee data, payroll information, and other confidential organizational details.
Organizations should implement immediate mitigations including input validation and output encoding controls to prevent malicious script injection into the video sharing parameters. The recommended approach involves sanitizing all user input through proper encoding mechanisms before storage and implementing Content Security Policy headers to limit script execution. Additionally, access controls should be reviewed to ensure that only authorized users can create or modify video content within the OrangeBuzz module. This vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and maps to ATT&CK technique T1566 for social engineering through malicious links. Organizations should also consider implementing web application firewalls to detect and block suspicious requests targeting the vulnerable parameter, and conduct thorough security testing to identify similar vulnerabilities in other application modules that may process user-supplied content without adequate sanitization.