PT-2022-16902 · Unknown · @Podium/Proxy+1

Krynos · Published 2022-04-06 · Updated 2022-04-14 · CVE-2022-24822

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions @podium/layout versions prior to 4.6.110 @podium/proxy versions prior to 4.2.74

Description The issue allows an attacker to take down the server by using the Trailer header as part of the request against proxy endpoints. All Podium layouts that include podlets with proxy endpoints are affected.

Recommendations For @podium/layout versions prior to 4.6.110, upgrade to version 4.6.110 or later. For @podium/proxy versions prior to 4.2.74, upgrade to version 4.2.74 or later. As a temporary workaround is not easily possible without upgrading, it is recommended to upgrade @podium/layout and/or @podium/proxy as soon as possible.

Exploit

Fix

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2022-24822

GHSA-3HJG-VC7R-RCRW

Affected Products

@Podium/Layout

@Podium/Proxy

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24822.json · Exploit
• https://github.com/podium-lib/layout/commit/fe43e655432b0a5f07b6475f67babcc2588fb039 · Patch
• https://github.com/podium-lib/proxy/commit/9698a40df081217ce142d4de71f929baaa339cdf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24822 · Security Note
• https://osv.dev/vulnerability/GHSA-3hjg-vc7r-rcrw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24822 · Vendor Advisory
• https://github.com/podium-lib/layout/releases/tag/v4.6.110 · Note
• https://github.com/podium-lib/proxy/releases/tag/v4.2.74 · Note
• https://github.com/podium-lib/proxy/security/advisories/GHSA-3hjg-vc7r-rcrw · Note
• https://t.me/cibsecurity/40257 · Telegram Post