PT-2023-1609 · Ibm · Ibm Aspera Faspex

Published 2023-02-03 · Updated 2025-10-27 · CVE-2022-47986

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Aspera Faspex versions 4.4.2 Patch Level 1 and earlier

Description The issue is related to a YAML deserialization flaw, allowing a remote attacker to execute arbitrary code on the system by sending a specially crafted obsolete API call. The obsolete API call was removed in Faspex 4.4.2 PL2. This flaw can be exploited to execute arbitrary code on the system.

Recommendations For IBM Aspera Faspex versions 4.4.2 Patch Level 1 and earlier, update to Faspex 4.4.2 Patch Level 2 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable /package relay/relay package API endpoint until a patch is available.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-01108

CVE-2022-47986

Affected Products

Ibm Aspera Faspex

References · 34

• 🔥 https://github.com/ohnonoyesyes/CVE-2022-47986 · Exploit
• 🔥 https://exploit-db.com/exploits/51316 · Exploit
• https://ibm.com/support/pages/node/6952319 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/243512 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01108 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/243512?_ga=2.189195179.1800390251.1676559338-700333034.1676325890 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-47986 · Security Note
• https://osv.dev/vulnerability/CVE-2022-47986 · Vendor Advisory
• https://github.com/vxunderground/MalwareSourceCode · Note
• https://github.com/MythicAgents/poseidon · Note
• https://github.com/MythicAgents/merlin · Note
• https://t.me/true_secator/4076 · Telegram Post
• https://t.me/thehackernews/3079 · Telegram Post
• https://twitter.com/fletch_ai/status/1825745000795353403 · Twitter Post
• https://t.me/aptreports/3624 · Telegram Post