PT-2022-22433 · Webswing · Webswing

Brian Sullivan + 1 · Published 2022-07-08 · Updated 2022-07-16 · CVE-2022-34914

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Webswing versions prior to 20.1.16 Webswing versions prior to 20.2.19 Webswing versions prior to 21.1.8 Webswing versions prior to 21.2.12 Webswing versions prior to 22.1.3

Description The issue allows X-Forwarded-For header injection. The client IP address is associated with a variable in the configuration page, specifically the {clientIp} variable, which can be used as an application startup argument. This variable can be manipulated by a client to store an arbitrary value, allowing the injection of multiple arguments into the session startup without sanitization. Systems not using the clientIP variable in the configuration are not affected.

Recommendations For Webswing versions prior to 20.1.16, update to version 20.1.16 or later. For Webswing versions prior to 20.2.19, update to version 20.2.19 or later. For Webswing versions prior to 21.1.8, update to version 21.1.8 or later. For Webswing versions prior to 21.2.12, update to version 21.2.12 or later. For Webswing versions prior to 22.1.3, update to version 22.1.3 or later. As a temporary workaround, consider restricting the use of the {clientIp} variable in the configuration page to minimize the risk of exploitation.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2022-34914

Affected Products

Webswing

References · 6

• https://webswing.org/blog/header-injection-vulnerability-cve-2022-34914 · Vendor Advisory
• https://webswing.org/docs/20.1/faq/client_ip.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34914 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34914 · Vendor Advisory
• https://t.me/cvenotify/32821 · Telegram Post
• https://t.me/cibsecurity/45839 · Telegram Post