PT-2022-2435 · Helidon · Helidon

Paulino Calderon · Published 2022-04-19 · Updated 2022-05-31 · CVE-2022-21404

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Helidon versions 1.4.10 and 2.0.0-RC1

Description The issue exists due to insufficient input validation in the Reactive WebServer component of Helidon, allowing an unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks can result in the takeover of Helidon. The vulnerability is difficult to exploit and can be leveraged by an attacker to execute arbitrary code using HTTP requests.

Recommendations For version 1.4.10, update to a version that includes the fix for this issue. For version 2.0.0-RC1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Reactive WebServer component until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-02840

CVE-2022-21404

Affected Products

Helidon

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-21404 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21404 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02840 · Security Note
• https://t.me/defcon_news/99411 · Telegram Post
• https://t.me/secharvester/12462 · Telegram Post
• https://t.me/cvenotify/29419 · Telegram Post
• https://t.me/thebugbountyhunter/6270 · Telegram Post
• https://t.me/cibsecurity/41140 · Telegram Post