CVE-2022-44784 Missing authorization in n/a
Remote attackers can access the exposed Axis AdminService to instantiate arbitrary services and execute code via JSP injection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-44784?
CVE-2022-44784 is a high-severity missing authorization vulnerability in n/a, published on 21 Nov 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of services provided by the Axis 1.4 instance, embedded directly into the applications, as hinted by the WEB-INF/web.xml file leaked through Local File Inclusion. Among the exposed services, there is the Axis AdminService, which, through the default configuration, should normally be accessible only by the localhost. Nevertheless, by trying to access the mentioned service, both in LFS and DL229, the service can actually be reached even by remote users, allowing creation of arbitrary services on the server side. When an attacker can reach the AdminService, they can use it to instantiate arbitrary services on the server. The exploit procedure is well known and described in Generic AXIS-SSRF exploitation. Basically, the attack consists of writing a JSP page inside the root directory of the web application, through the org.apache.axis.handlers.LogHandler class.
Weakness: CWE-306
Which versions are affected by CVE-2022-44784?
It affects 1 product.
Products include Maggioli Appalti \& Contratti.
How do I fix CVE-2022-44784?
No fix has been published for CVE-2022-44784 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-44784 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-44784 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jvw4-hhr9-8575.