PT-2022-7280 · Cbeust+1 · Testng+1

Published 2022-11-19 · Updated 2024-07-22 · CVE-2022-4065

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cbeust testng versions 7.5.0 through 7.7.0

Description A critical issue affects the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser, leading to path traversal. The attack can be launched remotely, potentially allowing an attacker to execute arbitrary code with a specially crafted zip file. The manipulation is limited to .xml, .yaml, and .yml files by default.

Recommendations For versions 7.5.0, 7.6.0, and 7.6.1, upgrade to version 7.5.1. For version 7.7.0, upgrade to version 7.7.1. As a temporary workaround, consider specifying which tests to run when invoking TestNG by configuring them on the CLI or in the build tool controlling the run. Do not run tests with untrusted JARs on the classpath, including pull requests on open source projects.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-02111

CVE-2022-4065

GHSA-RC2Q-X9MF-W3VF

MGASA-2023-0220

OESA-2024-1072

OPENSUSE-SU-2024:12533-1

SUSE-SU-2023:1690-1

SUSE-SU-2023_1690-1

SUSE-SU-2024:2568-1

SUSE-SU-2024_2568-1

Affected Products

Suse

Testng

References · 34

• 🔥 https://github.com/cbeust/testng/pull/2806 · Exploit
• https://github.com/cbeust/testng/releases/tag/7.7.1 · Patch
• https://github.com/cbeust/testng/commit/9150736cd2c123a6a3b60e6193630859f9f0422b · Patch
• https://osv.dev/vulnerability/MGASA-2023-0220 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4065 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-4065 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-4065 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-4065 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02111 · Security Note
• https://osv.dev/vulnerability/GHSA-rc2q-x9mf-w3vf · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-4065 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2568-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4065 · Security Note
• https://advisories.mageia.org/MGASA-2023-0220.html · Security Note
• https://osv.dev/vulnerability/OESA-2024-1072 · Vendor Advisory