PT-2022-22466 · Crow · Crow

Dejan Alvadzijevic · Published 2022-08-04 · Updated 2022-08-10 · CVE-2022-34970

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crow versions prior to 1.0+4

Description The issue is a heap-based buffer overflow that occurs via the function qs parse in query string.h. This allows attackers to remotely execute arbitrary code in the context of the vulnerable service.

Recommendations For Crow versions prior to 1.0+4, update to version 1.0+4 or later to resolve the issue. As a temporary workaround, consider restricting access to the qs parse function in query string.h to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2022-34970

Affected Products

Crow

References · 7

• 🔥 https://github.com/0xhebi/CVE-2022-34970/blob/master/report.md · Exploit
• https://github.com/CrowCpp/Crow/pull/486 · Patch
• https://osv.dev/vulnerability/CVE-2022-34970 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34970 · Security Note
• https://github.com/CrowCpp/Crow/releases/tag/v1.0%2B4 · Note
• https://cwe.mitre.org/data/definitions/193.html · Note
• https://t.me/cvenotify/34504 · Telegram Post