CVE-2022-26961: Italtel NetMatch-S XSS Vulnerability

CVE-2022-26961 Overview

CVE-2022-26961 is a stored Cross-Site Scripting (XSS) vulnerability affecting Italtel NetMatch-S version 5.0.0-20200703. The flaw resides in two JavaServer Pages: NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.jsp. Both endpoints fail to sanitize the name parameter before storing and rendering user-supplied content. An attacker with low-privileged access can inject arbitrary JavaScript that executes in the browser of any authenticated user who loads the affected page. The issue is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in the context of other authenticated administrators, enabling session theft, unauthorized configuration changes, and pivoting inside the NetMatch-S management interface.

Affected Products

Italtel NetMatch-S 5.0.0-20200703
NetMatch-S NMSCI-WebGui component (NP_IBCF-NATUP-01/backup_restore.jsp)
NetMatch-S NMSCI-WebGui component (NP_IBCF-MIBER-03/storage.jsp)

Discovery Timeline

2026-09-04 - CVE-2022-26961 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2022-26961

Vulnerability Analysis

The NetMatch-S web management interface exposes two JSP endpoints that accept a name parameter through HTTP requests. The server persists this parameter and later renders it back into HTML responses without output encoding. Because the input is stored server-side, every subsequent visit to the affected page re-triggers the payload. The stored nature of the flaw increases its severity compared to reflected XSS since exploitation does not require social engineering of each victim.

The attack requires an authenticated session with low privileges but affects users beyond the attacker's own scope, indicating a security boundary crossing between web application users.

Root Cause

The root cause is missing output encoding and input validation on the name parameter within backup_restore.jsp and storage.jsp. The JSP pages concatenate the parameter directly into rendered HTML without applying context-aware escaping. HTML control characters such as <, >, and " pass through unfiltered, allowing an attacker to break out of attribute or text contexts and introduce <script> tags or event handlers.

Attack Vector

An attacker authenticates to the NetMatch-S management console with any account that can reach the backup, restore, or storage functionality. The attacker submits a crafted name parameter containing a JavaScript payload. The server stores the payload and returns it in subsequent page renders. When another authenticated user, typically an administrator, browses the affected page, the injected script executes in their session context. The script can exfiltrate session cookies, issue authenticated API calls, or modify NetMatch-S configuration on behalf of the victim.

Technical exploitation details are documented in the TIM Red Team Italtel CVE-2022-26961 Analysis.

Detection Methods for CVE-2022-26961

Indicators of Compromise

HTTP POST or GET requests to NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp or NP_IBCF-MIBER-03/NMSCI-WebGui/storage.jsp where the name parameter contains HTML tags, javascript: URIs, or event handler attributes such as onerror= or onload=.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading NetMatch-S pages.
Web server logs showing repeated access to the affected JSP endpoints from low-privileged accounts.

Detection Strategies

Deploy a web application firewall rule that inspects the name parameter for HTML metacharacters and common XSS payload signatures on the affected JSP paths.
Correlate authentication logs with request logs to flag low-privileged users writing to configuration endpoints followed by administrator sessions loading the same resources.
Review stored NetMatch-S configuration objects for the presence of <script, onerror, or onload substrings in the name field.

Monitoring Recommendations

Enable verbose HTTP access logging on the NetMatch-S management interface and forward logs to a centralized analytics platform for retention and search.
Monitor administrator browser sessions for anomalous DOM activity and unexpected cross-origin requests originating from the NetMatch-S domain.
Alert on new or modified stored records within the backup, restore, and storage subsystems.

How to Mitigate CVE-2022-26961

Immediate Actions Required

Restrict access to the NetMatch-S management interface to trusted administrative networks using network-layer controls.
Audit existing NetMatch-S accounts and remove or downgrade any accounts that do not require write access to backup, restore, or storage functionality.
Inspect stored records in both affected JSP subsystems and remove entries containing HTML or JavaScript content.

Patch Information

No vendor advisory URL is available in the enriched data for CVE-2022-26961. Administrators should contact Italtel support to confirm whether a fixed release beyond 5.0.0-20200703 is available and apply the current supported build. Reference the TIM Red Team analysis for additional context on the affected components.

Workarounds

Place the NetMatch-S web interface behind a reverse proxy or web application firewall that enforces input validation on the name parameter and strips HTML control characters.
Enforce a strict Content Security Policy on responses served by the NMSCI-WebGui to limit inline script execution and block untrusted external script sources.
Require administrators to use isolated browser profiles or dedicated privileged access workstations when managing NetMatch-S to limit the blast radius of injected scripts.

bash

# Example WAF rule (ModSecurity) blocking HTML metacharacters in the name parameter
SecRule ARGS:name "@rx [<>\"']" \
    "id:1026961,phase:2,deny,status:403,\
     msg:'CVE-2022-26961 - Potential stored XSS in NetMatch-S name parameter',\
     tag:'CWE-79'"