CVE-2022-41958 Deserialization Vulnerability by yaml config input in super-xray
An attacker with local file access can execute arbitrary code via unsafe YAML deserialization in the super-xray vulnerability scanner.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-41958?
CVE-2022-41958 is a high-severity unsafe deserialization vulnerability in 4ra1n super-xray, published on 25 Nov 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit `4d0d5966` and will be included in future releases. Users are advised to upgrade. There are no known workarounds for this issue.
Weakness: CWE-502
Which versions are affected by CVE-2022-41958?
It affects 1 product.
Products include Super Xray Project Super Xray.
How do I fix CVE-2022-41958?
No fix has been published for CVE-2022-41958 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-41958 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-41958 exists.
Other vulnerabilities in 4ra1n super-xray
Sources
Also known as GHSA-39pv-4vmj-c4fr.