PT-2022-26183 · Unknown · Super-Xray

Published 2022-11-25 · Updated 2022-11-30 · CVE-2022-41958

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions super-xray versions prior to 0.7

Description The issue concerns a web vulnerability scanning tool that assumed trusted input for the program config stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. The problem has been addressed in a specific commit and will be included in future releases.

Recommendations For versions prior to 0.7, users are advised to upgrade to a newer version to resolve the issue. As a temporary workaround, consider restricting access to the yaml configuration file until the issue is resolved. There are no known workarounds for this issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-41958

GHSA-39PV-4VMJ-C4FR

Affected Products

Super-Xray

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41958.json · Exploit
• 🔥 https://github.com/4ra1n/super-xray/security/advisories/GHSA-39pv-4vmj-c4fr · Exploit
• https://github.com/4ra1n/super-xray/commit/4d0d59663596db03f39d7edd2be251d48b52dcfc · Patch
• https://osv.dev/vulnerability/CVE-2022-41958 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41958 · Security Note
• https://t.me/cibsecurity/53520 · Telegram Post
• https://t.me/cvenotify/38806 · Telegram Post
• https://t.me/cvenotify/38483 · Telegram Post