CVE-2022-39219 Bifrost users using basic authntication can bypass write permission limit
Attackers with read-only access can bypass write permission limits in Bifrost when using HTTP basic authentication, allowing unauthorized data modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39219?
CVE-2022-39219 is a high-severity authentication bypass vulnerability in brokercap Bifrost, published on 26 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests when they are normally forbidden from doing so. Version 1.8.7-release contains a patch. There are currently no known workarounds.
Weakness: CWE-287
Which versions are affected by CVE-2022-39219?
3 open source packages ship an affected version, including github.com/brokercap/Bifrost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/brokercap/Bifrost Go | All versions | 1.8.7-release |
github.com/brokercap/Bifrost Go | All versions | 1.8.7-release |
github.com/brokercap/Bifrost Go | All versions | 1.8.7-release |
Products include Xbifrost Bifrost.
How do I fix CVE-2022-39219?
Upgrade github.com/brokercap/Bifrost to 1.8.7-release or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-39219 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39219 exists.
Other vulnerabilities in brokercap Bifrost
Sources
Also known as GHSA-p6fh-xc6r-g5hw, GO-2022-1023.