CVE-2022-28864 in NetAct
Summary
by MITRE • 07/24/2023
An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include malicious code, which is then downloaded as a .csv or .xlsx file and executed on a victim machine. Here, the /aom/html/EditTemplate.jsf and /aom/html/ViewAllTemplatesPage.jsf templateName parameter is used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/21/2026
This vulnerability exists within Nokia NetAct 22's Administration of Measurements website section, specifically affecting the /aom/html/EditTemplate.jsf and /aom/html/ViewAllTemplatesPage.jsf pages. The flaw stems from insufficient input validation and sanitization of the templateName parameter, creating a path for arbitrary code execution through file manipulation. The vulnerability represents a classic server-side template injection issue that allows attackers to manipulate the template name parameter to include malicious payloads that are subsequently processed and executed when victims download the generated files.
The technical implementation of this vulnerability involves the improper handling of user-supplied input within the template name parameter, which is directly used to construct file names and execute file operations. When a malicious user modifies the templateName parameter to include executable code, the system processes this input without adequate sanitization, leading to the creation of malicious .csv or .xlsx files that contain embedded malicious code. This represents a form of insecure deserialization and file handling vulnerability that can be categorized under CWE-94, which describes "Improper Control of Generation of Code ('Code Injection')" and potentially CWE-74, "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')".
The operational impact of this vulnerability is significant as it allows remote code execution on victim machines through social engineering or automated exploitation. Attackers can craft malicious template names that, when downloaded and opened by unsuspecting users, execute arbitrary code on the victim's system. This creates a potential attack vector for privilege escalation, data exfiltration, or further network compromise. The vulnerability affects the administrative interface of Nokia NetAct, which typically requires elevated privileges to access, making it particularly dangerous for organizations that rely on this network management platform for critical infrastructure operations.
The attack surface is primarily limited to authenticated users with access to the Administration of Measurements section, but the impact extends beyond simple privilege escalation due to the file execution component. This vulnerability aligns with ATT&CK technique T1059.001, "Command and Scripting Interpreter: PowerShell", and T1059.007, "Command and Scripting Interpreter: JavaScript", as attackers can leverage the system to execute malicious scripts through the manipulated template files. Organizations should implement strict input validation and sanitization for all user-supplied parameters, particularly those used in file generation and processing operations. Additionally, the principle of least privilege should be enforced to limit access to administrative interfaces, while network segmentation can help contain potential exploitation attempts. Regular security updates and patches from Nokia should be applied immediately to address this vulnerability, as it represents a critical security risk that can lead to complete system compromise through the execution of malicious code on victim machines.