CVE-2022-25802

What it actually does

The flaw permits injection of arbitrary JavaScript into the application context by supplying a malicious Content-Type header on an attachment; when another user views the attachment the script executes with that user's privileges inside the RT web origin.

Why it matters to the business

Attackers can hijack user sessions, read or modify sensitive ticket data, and perform actions as legitimate staff, leading to data leakage or unauthorized changes in the ticketing system.

How an attack unfolds

An attacker creates an attachment whose Content-Type header contains a payload that bypasses sanitization, uploads it to a ticket, then waits for or lures a user with an active RT session to open or preview the attachment; the browser executes the injected script.

How to fix it

Upgrade Request Tracker to version 4.4.6 or later for the 4.4 branch and to version 5.0.3 or later for the 5.x branch; if immediate upgrade is not possible, restrict attachment uploads and disable inline preview of untrusted content types.

How to confirm the fix worked

Confirm the installed RT version is at least 4.4.6 or 5.0.3, then attempt to upload an attachment with a test Content-Type such as text/html;script and verify that the script is no longer executed when viewed by another account.

Typical attack path

1. Craft an attachment file whose Content-Type header contains a script payload
2. Upload the attachment to an existing or new ticket in RT
3. Lure or wait for a privileged user to view or download the attachment
4. Browser executes the injected script under the viewing user's session
5. Attacker uses the resulting access to read or alter ticket contents

How to detect it

Search web-server access logs for requests that include attachments followed immediately by requests containing script-related parameters or unusual Content-Type values; inspect RT attachment storage for files whose recorded MIME type does not match their actual content.

• Content-Type: text/html;script
• attachment upload followed by eval(
• RT attachment storage paths containing unexpected .html or .js extensions

What your security team should do

• Apply the fixed versions immediately given the public disclosure date and broad exposure of ticketing systems
• Audit existing attachments for suspicious Content-Type values
• Review and tighten attachment handling policies until patches are deployed
• Monitor for any new exploit code that may increase EPSS