CVE-2022-4492 Undertow client not checking server identity presented by server certificate in https connections
The Undertow client fails to verify server identity in HTTPS connections, allowing potential man-in-the-middle attacks or SSRF-like behaviors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-4492?
CVE-2022-4492 is a high-severity server-side request forgery vulnerability in Redhat Jboss Enterprise Application Platform, published on 23 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.
Weakness: CWE-918
Which versions are affected by CVE-2022-4492?
4 open source packages ship an affected version, including io.undertow:undertow-core. It affects 10 products.
| Package | Affected | Fixed in |
|---|---|---|
io.undertow:undertow-core Maven | All versions | 2.2.24.Final |
io.undertow:undertow-core Maven | All versions | 2.2.24.Final |
io.undertow:undertow-core Maven | From 2.3.0 | 2.3.5.Final |
io.undertow:undertow-core Maven | From 2.3.0 | 2.3.5.Final |
Products include Redhat Build of Quarkus, Redhat Integration Camel for Spring Boot, Redhat Integration Camel K, Redhat Integration Service Registry, Redhat Jboss Enterprise Application Platform, Redhat Jboss Fuse and 4 more.
How do I fix CVE-2022-4492?
Upgrade io.undertow:undertow-core to a fixed version for your release line: 2.2.24.Final or 2.3.5.Final.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-4492 being exploited?
There is no known exploitation of CVE-2022-4492 in the wild and no public exploit code.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2023-2974 quarkus-core vulnerable to client driven TLS cipher downgrading
- CVE-2023-1664 Keycloak Untrusted Certificate Validation vulnerability
- CVE-2021-3914 SmallRye Health UI Cross-site Scripting vulnerability
- CVE-2023-6393 Quarkus: potential invalid reuse of context when @cacheresult on a uni is used
- CVE-2021-3536 Cross-site Scripting in Wildfly
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as DEBIAN-CVE-2022-4492, GHSA-pfcc-3g6r-8rg8, UBUNTU-CVE-2022-4492.