PT-2022-26145 · Unknown · Zulip Server

Alexmv · Published 2022-11-16 · Updated 2022-11-21 · CVE-2022-41914

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zulip Server versions 5.0 through 5.6

Description Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management (SCIM) account management enabled, it might theoretically be possible for an attacker to infer the value of the SCIM bearer token by performing a sophisticated timing analysis on a large number of failing requests. If successful, this would allow the attacker to impersonate the SCIM client for its abilities to read and update user accounts in the Zulip organization.

Recommendations For Zulip Server versions 5.0 through 5.6, consider disabling SCIM account management until a patch is available to prevent potential exploitation. Restrict access to the SCIM client to minimize the risk of impersonation. Avoid using the SCIM bearer token in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-200

CWE-203

Related Identifiers

CVE-2022-41914

GHSA-Q5GX-377V-W76F

Affected Products

Zulip Server

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41914.json · Exploit
• https://github.com/zulip/zulip/commit/59edbfa4113d140d3e20126bc65f4d67b2a8ffe5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41914 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41914 · Vendor Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-q5gx-377v-w76f · Note
• https://t.me/cvenotify/37906 · Telegram Post
• https://t.me/cibsecurity/53059 · Telegram Post