PT-2022-22814 · Wapples · Wapples

Published 2022-09-13 · Updated 2022-10-01 · CVE-2022-35413

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WAPPLES versions through 6.0

Description A threat actor could use a hardcoded systemi account to access the system configuration and confidential information, such as SSL keys, via an HTTPS request to the "/webapi/" URI on port 443 or 5001. The account is accessible via db/wp.no1, as configured in the /opt/penta/wapples/script/wcc auto scaling.py file.

Recommendations For WAPPLES versions through 6.0, consider disabling access to the hardcoded systemi account until a patch is available. Restrict access to the /webapi/ URI on port 443 or 5001 to minimize the risk of exploitation. Avoid using the db/wp.no1 configuration to access the system configuration and confidential information until the issue is resolved.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-35413

Affected Products

Wapples

References · 8

• 🔥 https://medium.com/@_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb · Exploit
• https://pentasecurity.com/product/wapples · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35413 · Security Note
• https://azuremarketplace.microsoft.com/en/marketplace/apps/penta-security-systems-inc.wapples_sa_v6?tab=Overview · Vendor Advisory
• https://t.me/cvenotify/36122 · Telegram Post
• https://t.me/cibsecurity/49750 · Telegram Post
• https://medium.com/%40_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb · Note