PT-2022-2858 · Snipe-It · Snipe-It

Published 2022-01-10 · Updated 2022-05-10 · CVE-2022-23064

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Snipe-IT versions v3.0-alpha through v5.3.7

Description The issue is related to Host Header Injection in the password reset function of Snipe-IT. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server, thus leading to password reset token leak and potentially allowing account take over. The vulnerability is due to the incorrect neutralization of special elements in the output.

Recommendations For versions v3.0-alpha through v5.3.7, as a temporary workaround, consider disabling the password reset function until a patch is available. Restrict access to the password reset module to minimize the risk of exploitation. Avoid using the password reset link in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2022-03415

CVE-2022-23064

GHSA-9VH6-QFV6-VCQP

Affected Products

Snipe-It

References · 10

• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2022-23064 · Exploit
• https://github.com/snipe/snipe-it/commit/0c4768fd2a11ac26a61814cef23a71061bfd8bcc · Patch
• https://osv.dev/vulnerability/CVE-2022-23064 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23064 · Security Note
• https://osv.dev/vulnerability/GHSA-9vh6-qfv6-vcqp · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03415 · Security Note
• https://github.com/snipe/snipe-it · Note
• https://t.me/cibsecurity/41714 · Telegram Post
• https://securitylab.ru/news/531506.php · Note
• https://vuldb.com/?id.198794 · Note