CVE-2022-47986

2023-02-1700:00:00

attackerkb.com

ibm aspera faspex 4.4.1

yaml deserialization

remote code execution

network perimeter

software vulnerability

secure file transfer service

privileged information

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.958

Percentile

99.5%

JSON

IBM Aspera Faspex 4.4.1 could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

Recent assessments:

rbowes-r7 at February 17, 2023 10:13pm UTC reported:

This lives on the network perimeter and uses laughably old versions of software (like Ruby 1.9.3). I had more trouble preventing it from crashing than actually exploiting it. This also tends to store privileged information, since it’s a secure file transfer service. Kinda really bad.

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 5