PT-2023-13700 · Rapid7 · Rapid7 Nexpose+1

Published 2023-02-01 · Updated 2023-02-09 · CVE-2022-3913

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177

Description The issue arises from the failure to validate the certificate of the update server when downloading updates. This could allow an attacker in a privileged position on the network to provide their own HTTPS endpoint or intercept communications to the legitimate endpoint. The attacker would need pre-existing access to at least one node on the network path between the Rapid7-controlled update server and the Nexpose/InsightVM application, and the ability to either spoof the update server's FQDN or redirect legitimate traffic to the attacker's server. Note that even in this scenario, an attacker could not normally replace an update package with a malicious package, since the update process validates a separate, code-signing certificate.

Recommendations For Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177, update to version 6.6.178 or later to resolve the issue. As a temporary workaround, consider restricting access to the update server or implementing additional network security measures to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-3913

Affected Products

Insightvm

Rapid7 Nexpose

References · 6

• https://osv.dev/vulnerability/CVE-2022-3913 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3913 · Security Note
• https://docs.rapid7.com/release-notes/nexpose/20230201 · Vendor Advisory
• https://rapid7.com/blog/post/2022/12/07/cve-2022-4261-rapid7-nexpose-update-validation-issue-fixed · Vendor Advisory
• https://t.me/cvenotify/43390 · Telegram Post
• https://t.me/cibsecurity/57356 · Telegram Post