CVE-2022-36180

What it actually does

The flaw permits injection of arbitrary JavaScript into responses via unsanitized query parameters (message, plug) on multiple index.php endpoints, resulting in reflected cross-site scripting that executes attacker-supplied code in victim browsers with the application's origin.

Why it matters to the business

Successful exploitation can lead to theft of user sessions, unauthorized actions within the directory management interface, and potential exposure of sensitive organizational data, increasing risk of account takeover and compliance violations.

How an attack unfolds

An attacker embeds a script payload in the message or plug parameter of a crafted URL and delivers the link to a victim user. When the user loads the page, the browser executes the injected script in the application's security context, enabling session hijacking or further attacks.

How to fix it

Upgrade Fusiondirectory to a patched release that properly sanitizes and escapes the message and plug parameters. Apply input validation and output encoding on all reflected query values; monitor vendor advisories for the exact fixed version beyond 1.3.

How to confirm the fix worked

Confirm that the message, plug, and signout parameters are HTML-escaped or rejected when containing script tags or event handlers; retest the three listed index.php URLs with benign payloads to verify no execution occurs.

Typical attack path

1. Identify vulnerable Fusiondirectory 1.3 endpoints accepting message or plug parameters
2. Craft URL containing malicious JavaScript payload in one of the reflected parameters
3. Deliver the malicious link to an authenticated user via phishing or other social engineering
4. Victim interaction triggers script execution allowing cookie theft or UI manipulation

How to detect it

Search web server access logs for requests to /fusiondirectory/index.php containing suspicious characters such as <script, onerror=, or javascript: in the message or plug parameters; inspect browser developer tools or proxy captures for unexpected script execution on those endpoints.

What your security team should do

• Prioritize upgrade of all Fusiondirectory 1.3 instances to the latest fixed release
• Implement web application firewall rules to block common XSS patterns in query strings
• Educate users on verifying URLs before clicking links to the application
• Review logs for unusual query parameters containing script syntax