CVE-2022-25813

Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SSTI. A RCE is then possible.

En Apache OFBiz, versiones 18.12.05 y anteriores, un atacante que actúe como usuario anónimo del plugin de comercio electrónico, puede insertar un contenido malicioso en el campo "Subject" de un mensaje de la página "Contact us". A continuación, un administrador de la fiesta necesita listar las comunicaciones en el componente de la fiesta para activar el SSTI. Entonces es posible un RCE

*Credits: Matei "Mal" Badanoiu

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-02-23 CVE Reserved
2022-09-02 CVE Published
2023-12-17 First Exploit
2024-08-03 CVE Updated
2024-08-29 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

CAPEC

References (3)

URL	Tag	Source

URL	Date	SRC
https://github.com/mbadanoiu/CVE-2022-25813	2023-12-17

URL	Date	SRC
http://www.openwall.com/lists/oss-security/2022/09/02/4	2022-09-07
https://lists.apache.org/thread/vmj5s0qb59t0lvzf3vol3z1sc3sgyb2b	2022-09-07

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Ofbiz Search vendor "Apache" for product "Ofbiz"				< 18.12.06 Search vendor "Apache" for product "Ofbiz" and version " < 18.12.06"		-		Affected