Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-23466

CVE-2022-23466: teler dashboard vulnerable to DOM-based cross-site scripting (XSS)

3.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-23466
GHSA ID
GHSA-xr7p-8q82-878q
EPSS Score
0.26208%
CWE
CWE-79
Published
12/6/2022
Updated
1/31/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
teler.appgo>= 2.0.0-rc, <= 2.0.0-rc.32.0.0-rc.4
teler.appgo= 2.0.0-dev2.0.0-dev.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unsanitized use of innerHTML with user-controlled data in three key locations: 1) When populating category names (data.category), 2) When displaying matches (data[data.element]), and 3) When creating signature filter items (name parameter). The commit diff shows these were all modified to use a new escapeHTML function, confirming these were the vulnerable points. The lack of HTML entity escaping in these DOM manipulation operations directly enables DOM-based XSS.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### **s*ription t*l*r prior to v*rsion <= *.*.*-r*.* is vuln*r**l* to *OM-**s** *ross-sit* s*riptin* (XSS) in t** t*l*r **s**o*r*. W**n t*l*r r*qu*sts m*ss***s *rom t** *v*nt str**m on t** `/*v*nts` *n*point, t** lo* **t* *ispl*y** on t** **s**o*r*

Reasoning

T** vuln*r**ility st*ms *rom uns*nitiz** us* o* `inn*r*TML` wit* us*r-*ontroll** **t* in t*r** k*y lo**tions: *) W**n popul*tin* **t**ory n*m*s (`**t*.**t**ory`), *) W**n *ispl*yin* m*t***s (`**t*[**t*.*l*m*nt]`), *n* *) W**n *r**tin* si*n*tur* *ilt*