PT-2022-26175 · Unknown · Super-Xray

4Ra1N · CVE-2022-41945 · Published 2022-11-21 · Updated 2023-06-27

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions super-xray version 0.1-beta

Description The issue is related to a vulnerability scanner GUI launcher. In the affected version, the URL is not filtered and is directly spliced into the command, resulting in a possible Remote Code Execution (RCE) issue.

Recommendations For super-xray version 0.1-beta, upgrade to super-xray 0.2-beta to resolve the issue. As a temporary workaround, consider filtering or validating URLs before they are spliced into commands to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-41945

GHSA-732J-763P-CVQG

Affected Products

Super-Xray

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41945.json · Exploit
• 🔥 https://github.com/4ra1n/super-xray/security/advisories/GHSA-732j-763p-cvqg · Exploit
• https://osv.dev/vulnerability/CVE-2022-41945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41945 · Security Note
• https://github.com/4ra1n/super-xray/releases/tag/0.2-beta · Note
• https://t.me/cibsecurity/53297 · Telegram Post
• https://t.me/cvenotify/38180 · Telegram Post