CVE-2022-28865 in NetAct
Summary
by MITRE • 07/24/2023
An issue was discovered in Nokia NetAct 22 through the Site Configuration Tool website section. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. Here, the /netact/sct filename parameter is used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/21/2026
The vulnerability identified as CVE-2022-28865 represents a critical server-side request forgery and cross-site scripting flaw within Nokia NetAct 22's Site Configuration Tool web interface. This issue stems from inadequate input validation and sanitization mechanisms that fail to properly process filename parameters submitted during file upload operations. The vulnerability specifically affects the /netact/sct endpoint where user-supplied filenames are directly incorporated into web responses without proper encoding or validation, creating an environment where malicious actors can inject executable JavaScript code into file names that are subsequently served to unsuspecting victims.
The technical exploitation of this vulnerability occurs through a carefully crafted filename modification attack that leverages the web application's trust in user-provided input. When a malicious user uploads a file with a filename containing embedded javascript code, the application fails to sanitize this input before storing and serving it back to other users. This creates a persistent cross-site scripting vector where the injected javascript executes within the victim's browser context, potentially allowing for session hijacking, data exfiltration, or redirection to malicious sites. The vulnerability demonstrates a classic lack of proper output encoding and input validation that aligns with CWE-79 Cross-site Scripting flaws, where the application fails to neutralize or escape user-controllable data before it is rendered in the browser.
The operational impact of this vulnerability extends beyond simple script execution, creating a significant risk for organizations relying on Nokia NetAct 22 for network management operations. Attackers can leverage this vulnerability to compromise the integrity of the Site Configuration Tool environment, potentially gaining unauthorized access to sensitive network configuration data or using the compromised system as a pivot point for further attacks within the network infrastructure. The delivery mechanism through URL parameters makes this vulnerability particularly dangerous as it can be propagated through email campaigns or public posting platforms, enabling widespread exploitation without requiring direct system access. This aligns with ATT&CK technique T1190 Exploit Public-Facing Application, where attackers target web applications to establish initial access or escalate privileges.
Organizations utilizing Nokia NetAct 22 must implement immediate mitigations including input validation and sanitization of all filename parameters, implementing proper output encoding for all user-controllable data, and restricting file upload functionality to prevent javascript code injection. The vulnerability also necessitates network-level monitoring for suspicious filename patterns and regular security assessments of web applications to identify similar input validation flaws. Additionally, implementing content security policies and restricting file type uploads can significantly reduce the attack surface. The vulnerability serves as a reminder of the critical importance of proper input validation and output encoding practices in web application security, particularly in network management systems where compromise can lead to widespread infrastructure disruption. Organizations should also consider implementing web application firewalls and regular security patching to address similar vulnerabilities in third-party applications.