PT-2022-26137 · Opensearch · Opensearch Notifications Plugin

Cehenkle · Published 2022-11-11 · Updated 2023-07-26 · CVE-2022-41906

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenSearch Notifications Plugin versions 2.0.0 through 2.2.0

Description A potential Server-Side Request Forgery (SSRF) issue in the OpenSearch Notifications Plugin could allow an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests, exceeding the plugin's intended scope. The issue affects the plugin's ability to send notifications via various channels, including Email, Slack, Amazon Chime, and Custom web-hook.

Recommendations For OpenSearch Notifications Plugin versions 2.0.0 through 2.2.0, update to OpenSearch 2.2.1 or later to resolve the issue. At the moment, there is no information about other workarounds for this vulnerability.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-41906

GHSA-PFC4-3436-JGRW

Affected Products

Opensearch Notifications Plugin

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41906.json · Exploit
• https://github.com/opensearch-project/notifications/pull/507 · Patch
• https://github.com/opensearch-project/notifications/pull/496 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41906 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41906 · Vendor Advisory
• https://github.com/opensearch-project/notifications/security/advisories/GHSA-pfc4-3436-jgrw · Note
• https://t.me/cvenotify/37554 · Telegram Post
• https://t.me/cvenotify/55152 · Telegram Post
• https://t.me/cibsecurity/52876 · Telegram Post