Code injection in EJS - CVE-2022-29078

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU63903

Code injection in EJS - CVE-2022-29078

Published: June 1, 2022 / Updated: November 5, 2024


Vulnerability identifier: #VU63903
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-29078
CWE-ID: CWE-74
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation when parsing data passed to "settings[view options][outputFunctionName]". A remote attacker can send specially crafted request to the application, perform server-side template injection and execute arbitrary code on the system.


Affected software

EJS
IBM Edge Application Manager
IBM Integration Bus
IBM Cloud Pak for Business Automation
Automation Assets in IBM Cloud Pak for Integration (CP4I)
App Connect Enterprise Certified Container
IBM Cloud Pak for Watson AIOps

How to mitigate CVE-2022-29078

Install updates from vendor's website.

EJS - update to 3.1.7
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2020.4.1-7, 2022.2.1-0
App Connect Enterprise Certified Container - addressed in versions 1.1.9, 4.2.0
IBM Cloud Pak for Watson AIOps - update to 3.5

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins