CVE-2022-44262 ff4j is vulnerable to Remote Code Execution (RCE)
Attackers can execute arbitrary code remotely via a code injection vulnerability in the ff4j feature flag library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-44262?
CVE-2022-44262 is a critical code injection vulnerability in n/a, published on 1 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).
Weakness: CWE-94
Which versions are affected by CVE-2022-44262?
2 open source packages ship an affected version, including org.ff4j:ff4j-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.ff4j:ff4j-core Maven | From 1.8.1 | 1.9 |
org.ff4j:ff4j-core Maven | From 1.8.1 | 1.9 |
Products include Ff4j Ff4j.
How do I fix CVE-2022-44262?
Upgrade org.ff4j:ff4j-core to 1.9 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-44262 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-44262 exists.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as GHSA-65hj-9ppw-77xc.