CVE-2022-0757 Rapid7 Nexpose SQL Injection

What is CVE-2022-0757?

CVE-2022-0757 is a medium-severity SQL injection vulnerability in Rapid7 Nexpose, published on 17 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to an SQL Injection vulnerability, whereby valid search operators are not defined. This lack of validation can allow a logged-in, authenticated attacker to manipulate the "ANY" and "OR" operators in the SearchCriteria and inject SQL code. This issue was fixed in Rapid7 Nexpose version 6.6.129.

Weakness: CWE-89

Which versions are affected by CVE-2022-0757?

It affects 1 product.

Products include Rapid7 Nexpose.

How do I fix CVE-2022-0757?

No fix has been published for CVE-2022-0757 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-0757 being exploited?

There is no known exploitation of CVE-2022-0757 in the wild and no public exploit code.

Other vulnerabilities in Rapid7 Nexpose

• CVE-2017-5264 Cross-site request forgery in Nexpose High 8.8
• CVE-2019-5638 Rapid7 Nexpose Insufficient Session Management High 8.7
• CVE-2017-5243 Weak cryptography in Nexpose hardware appliance High 8.5
• CVE-2017-5232 Other in Nexpose High 7.8
• CVE-2017-5230 Hardcoded credentials in Nexpose High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-76q8-942h-339c.