Lucene search

SnykCVE-2022-25842

HistoryMay 01, 2022 - 4:15 p.m.

CVE-2022-25842

2022-05-0116:15:08

CWE-22

snyk

web.nvd.nist.gov

cve-2022-25842

arbitrary file write

archive extraction

zip slip

remote command execution

nvd

information security

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.024

Percentile

90.0%

JSON

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. …/…/evil.exe). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.

Affected configurations

Nvd

Node

alibabagroupone-java-agent

VendorProductVersionCPE
alibabagroupone-java-agent*cpe:2.3:a:alibabagroup:one-java-agent:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
alibabagroup	one-java-agent	*	cpe:2.3:a:alibabagroup:one-java-agent::::::::

CNA Affected

[
  {
    "product": "com.alibaba.oneagent:one-java-agent-plugin",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/alibaba/one-java-agent/blob/1f399a2299a8a409d15ea6111a7098629b8f1050/one-java-agent-plugin/src/main/java/com/alibaba/oneagent/utils/IOUtils.java

github.com/alibaba/one-java-agent/pull/29

github.com/alibaba/one-java-agent/pull/29/commits/359603b63fc6c59d8b57e061c171954bab3433bf

snyk.io/vuln/SNYK-JAVA-COMALIBABAONEAGENT-2407874

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.024

Percentile

90.0%

JSON

Related for CVE-2022-25842