PT-2022-22971 · Kvf-Admin · Kvf-Admin

Alter1125 · Published 2022-07-13 · Updated 2023-08-08 · CVE-2022-35857

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions kvf-admin through 2022-02-12

Description The issue allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parameter is encrypted with a hardcoded key from the com.kalvin.kvf.common.shiro.ShiroConfig file.

Recommendations For kvf-admin through 2022-02-12, consider disabling the deserialization of the rememberMe parameter until a patch is available. Restrict access to the com.kalvin.kvf.common.shiro.ShiroConfig file to minimize the risk of exploitation. Avoid using the rememberMe parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-35857

Affected Products

Kvf-Admin

References · 7

• 🔥 https://github.com/kalvinGit/kvf-admin/issues/16 · Exploit
• https://osv.dev/vulnerability/CVE-2022-35857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35857 · Security Note
• https://t.me/cvenotify/33033 · Telegram Post
• https://t.me/cvenotify/33063 · Telegram Post
• https://t.me/cibsecurity/46220 · Telegram Post
• https://t.me/cvenotify/33549 · Telegram Post