Code Injection in Apache Commons Configuration - CVE-2022-33980

Vulnerability identifier: #VU64957

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-33980

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Apache Commons Configuration
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
IBM Sterling Connect:Direct for Microsoft Windows
Oracle Business Intelligence Enterprise Edition
Oracle Retail Xstore Point of Service
Db2 Graph
IBM Cloud Pak for Watson AIOps
Debian Linux
IBM Operations Analytics Predictive Insights
Log Analysis
Oracle Banking Enterprise Default Management
Oracle Banking Deposits and Lines of Credit Servicing
Oracle Banking Party Management
IBM SPSS Analytic Server
IBM Common Licensing
Infrastructure Technology
Oracle Middleware Common Libraries and Tools
Middleware Common Libraries and Tools
IBM SPSS Modeler
Sterling Connect Direct File Agent
IBM Cloud Pak for Multicloud Management Monitoring
IBM Sterling Connect:Direct for UNIX
IBM Sterling Control Center
Red Hat Satellite
IBM Data Risk Manager
Oracle Financial Services Crime and Compliance Management Studio
Pipeline Utility Steps
AMQ Broker
Fuse
Oracle Healthcare Foundation
Oracle Communications BRM - Elastic Charging Engine
commons-configuration2 (Debian package)
Jazz Reporting Service

Install updates from vendor's website.

Apache Commons Configuration - update to 2.8.0
Log Analysis - update to 1.3.7.2 IF001
IBM Data Risk Manager - update to 2.0.6.15
Pipeline Utility Steps - update to 2.13.1
IBM SPSS Analytic Server - update to 3.4.0.0.1
IBM Sterling Connect:Direct for Microsoft Windows - addressed in versions 4.8.0.3.49, 6.0.0.4.56, 6.1.0.2.50, 6.2.0.4.13
AMQ Broker - update to 7.10.1
Fuse - update to 7.11.1
Db2 Graph - addressed in versions 1.0.0.1562-amd64, 1.0.0.1562-s390x, 1.0.0.1562-ppcle, 1.0.0.1598-amd64, 1.0.0.1598-s390x, 1.0.0.1598-ppcle
Sterling Connect Direct File Agent - update to 1.4.0.2.027
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 6
commons-configuration2 (Debian package) - update to 2.8.0-1~deb11u1
IBM Cloud Pak for Watson AIOps - update to 3.4.2
IBM Sterling Connect:Direct for UNIX - addressed in versions 4.3.0.1.102, 6.0.0.2.136, 6.1.0.4.62, 6.2.0.4.18
IBM Sterling Control Center - update to 6.2.1.0.8
Red Hat Satellite - update to 6.13
Jazz Reporting Service - update to 7.0.2 iFix021

• Exploit #8494 - CVE-2022-33980-POC (POC for CVE-2022-33980 (Apache Commons Configuration RCE vulnerability)) (October 19, 2022)
• Exploit #8239 - CVE-2022-33980 (CVE) (August 10, 2022)
• Exploit #8125 - CVE-2022-33980-Apache-Commons-Configuration-RCE (CVE-2022-33980 Apache Commons Configuration 远程命令执行漏洞) (July 10, 2022)
• Exploit #8124 - CVE-2022-33980-Apache-Commons-Configuration-RCE () (July 10, 2022)

• https://lists.apache.org/thread/tdf5n7j80lfxdhs2764vn0xmpfodm87s

• Remote code execution in Apache Commons Configuration
• Multiple vulnerabilities in IBM Common Licensing
• Remote code execution in IBM Sterling Connect:Direct File Agent
• IBM SPSS Modeler update for Apache Commons Configuration
• IBM Sterling Connect:Direct for Microsoft Windows update for Apache Commons Configuration
• Remote code execution in IBM Cloud PAK for Watson AI Ops
• Remote code execution in IBM Sterling Control Center
• Remote code execution in IBM Sterling Connect:Direct for UNIX
• Remote code execution in IBM SPSS Analytic Server
• Multiple vulnerabilities in Red Hat AMQ Broker 7.10
• Code Injection in Oracle Healthcare Foundation
• Code Injection in Hyperion Infrastructure Technology
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Remote code execution in Jenkins Pipeline Utility Steps plugin
• IBM Log Analysis update for Apache Commons Configuration
• Debian update for commons-configuration2
• Multiple vulnerabilities in Red Hat Fuse
• IBM Operations Analytics Predictive Insights update for Apache Commons Text
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in Oracle Financial Services Crime and Compliance Management Studio
• Multiple vulnerabilities in Oracle Banking Party Management
• Multiple vulnerabilities in Oracle Banking Enterprise Default Management
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Multiple vulnerabilities in Middleware Common Libraries and Tools
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Multiple vulnerabilities in Red Hat Satellite 6.13
• Multiple vulnerabilities in IBM Db2 Graph
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM Jazz Reporting Service
• Multiple vulnerabilities in Oracle Banking Deposits and Lines of Credit Servicing
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools