PT-2022-25884 · Devexpress · Devexpress Asp.Net

Published 2022-10-18 · Updated 2024-08-03 · CVE-2022-41479

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DevExpress ASP.NET Web Forms Build version 19.2.3

Description The DevExpress Resource Handler (ASPxHttpHandlerModule) does not verify the referenced objects in the "/DXR.axd?r=" HTTP GET parameter. This leads to an Insecure Direct Object References (IDOR) issue, allowing attackers to access the application source code. Note that the vendor disputes this, stating the retrieved source code is only the DevExpress client-side application code, which is intentionally readable by web browsers, and a site's custom code and data is never accessible via this approach.

Recommendations For version 19.2.3, consider restricting access to the "/DXR.axd" API endpoint to minimize the risk of exploitation, as a temporary workaround, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-41479

Affected Products

Devexpress Asp.Net

References · 7

• 🔥 https://github.com/IthacaLabs/DevExpress/tree/main/ASP.NET_Web_Forms_Build_19.2.3 · Exploit
• https://osv.dev/vulnerability/CVE-2022-41479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41479 · Security Note
• https://supportcenter.devexpress.com/ticket/details/t190349/false-positive-vulnerabilities-known-alerts-detected-by-various-security-scanners-and · Note
• https://t.me/cibsecurity/51682 · Telegram Post
• https://t.me/cvenotify/88646 · Telegram Post
• https://supportcenter.devexpress.com/ticket/details/t1171808/penetration-test-idor-source-code-cve-2022-41479 · Note