PT-2022-17612 · Unknown · V-Server Lite

Liran Tal + 1 · Published 2022-12-20 · Updated 2022-12-29 · CVE-2022-25940

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions lite-server versions all

Description The issue arises when an attacker sends an HTTP request that includes control characters, which the decodeURI() function is unable to parse, leading to a Denial of Service (DoS). This occurs when the decodeURI() function encounters characters it cannot process, resulting in the service becoming unavailable.

Recommendations For all versions, consider disabling the decodeURI() function or restricting HTTP requests that include control characters until a patch is available. As a temporary workaround, restrict access to the HTTP endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

CVE-2022-25940

GHSA-89W7-5Q45-R53W

Affected Products

V-Server Lite

References · 9

• 🔥 https://gist.github.com/lirantal/832382155e00da92bfd8bb3adea474eb · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3175617 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-LITESERVER-3153540 · Exploit
• https://osv.dev/vulnerability/GHSA-89w7-5q45-r53w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25940 · Security Note
• https://github.com/johnpapa/lite-server · Note
• https://t.me/cvenotify/40959 · Telegram Post
• https://t.me/cibsecurity/54949 · Telegram Post