Code Injection in Linaro Automated Validation Architecture (LAVA) - CVE-2022-45132
Published: January 16, 2023
Vulnerability identifier: #VU71186
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-45132
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation when handling Jinja2 templates. A remote user can submit a specially crafted Jinja2 template to the REST API endpoint for validating device configuration files in lava-server and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Linaro Automated Validation Architecture (LAVA)
How to mitigate CVE-2022-45132
Install updates from vendor's website.
Linaro Automated Validation Architecture (LAVA) - update to 2022.11.1