CVE-2022-24392 Authenticated Command Injection Vulnerability in Fidelis Network and Deception
Authenticated attackers can execute arbitrary system commands on Fidelis Network and Deception CommandPost via a crafted HTTP request.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-24392?
CVE-2022-24392 is a high-severity command injection vulnerability in Fidelis Deception, published on 17 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed_comm_test” value for the “feed” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response via an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
Which versions are affected by CVE-2022-24392?
It affects 2 products.
Products include Fidelissecurity Deception, Fidelissecurity Network.
How do I fix CVE-2022-24392?
No fix has been published for CVE-2022-24392 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-24392 being exploited?
There is no known exploitation of CVE-2022-24392 in the wild and no public exploit code.
Other vulnerabilities in Fidelis Deception
- CVE-2021-35047 Privileged Command Injection Vulnerability in Fidelis Network and Deception
- CVE-2021-35049 Command Injection Vulnerability in Fidelis Network and Deception
- CVE-2021-35048 Unauthenticated SQL Injection Vulnerability in Fidelis Network and Deception
- CVE-2022-24388 Authenticated Privileged Command Injection Vulnerability in Fidelis Network and Deception
- CVE-2022-24389 Authenticated Privileged Command Injection Vulnerability in Fidelis Network and Deception
Sources
Also known as GHSA-gqc3-pj63-8cmq.