PT-2022-23761 · Ahsay · Ahsaycbs

Jan Friedli · Published 2022-09-21 · Updated 2025-05-28 · CVE-2022-37027

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ahsay AhsayCBS version 9.1.4.0

Description The issue allows an authenticated system user to inject arbitrary Java JVM options. Administrators with the ability to modify the Runtime Options in the web interface can inject Java Runtime Options, which take effect after a restart. This can enable an attacker to enable JMX services, potentially achieving remote code execution as the system user.

Recommendations For Ahsay AhsayCBS version 9.1.4.0, consider restricting access to the Runtime Options in the web interface to prevent arbitrary Java JVM options injection until a patch is available. As a temporary workaround, avoid using the feature to modify Runtime Options to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2022-37027

Affected Products

Ahsaycbs

References · 9

• 🔥 https://compass-security.com/fileadmin/Research/Advisories/2022_12_CSNC-2022-009_AhsayCBS_Java_Runtime_Parameter_Injection.txt · Exploit
• https://osv.dev/vulnerability/CVE-2022-37027 · Vendor Advisory
• https://ahsay.com/jsp/en/downloads/ahsay-downloads_latest-software_ahsaycbs.jsp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37027 · Security Note
• https://ahsay.com/partners/en/home/index.jsp?pageContentKey=ahsay_assets_latest_hotfix · Vendor Advisory
• https://wiki.ahsay.com/doku.php?id=public:resources:release_notes_v9320 · Vendor Advisory
• https://compass-security.com/en/research/advisories · Note
• https://t.me/cvenotify/123837 · Telegram Post
• https://t.me/cibsecurity/50202 · Telegram Post