CVE-2022-32173: 
C# vulnerability analysis and mitigation

CVE-2022-32173 affects OrchardCore versions rc1-11259 through v1.2.2. The vulnerability allows an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users (NVD, Mend).

The vulnerability is classified as an HTML injection vulnerability with a CVSS v3.1 Base Score of 5.4 (Medium). The attack vector is Network-based, requires Low attack complexity, Low privileges, and User interaction. The vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (Mend).

When exploited, once an admin accesses the dashboard, the injected modal dialog will be presented, preventing access to any other element on the page. The dialog waits for input, and upon submission, the admin will be redirected to a malicious host where the attacker can capture confidential data, such as user credentials (Mend).

The vulnerability can be exploited by an authenticated user with editor role privileges. The attack requires first enabling the 'Manage the Admin Dashboard' privilege for the Editor role, then using HTML editing capabilities within the dashboard to inject malicious code. A proof of concept exists demonstrating the complete attack chain (Mend).

The vulnerability has been patched in OrchardCore version v1.4.0. The fix includes removing the form tag from allowed tags during sanitization (GitHub Patch).