CVE-2022-45442 Sinatra vulnerable to Reflected File Download attack
Attackers can exploit reflected file download vulnerabilities in Sinatra to execute malicious code or bypass security controls via crafted filenames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-45442?
CVE-2022-45442 is a high-severity vulnerability in Debian Debian Linux, published on 28 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.
Weakness: CWE-494
Which versions are affected by CVE-2022-45442?
4 open source packages ship an affected version, including sinatra. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
sinatra RubyGems | From 2.0.0 | 2.2.3 |
sinatra RubyGems | From 2.0.0 | 2.2.3 |
sinatra RubyGems | From 3.0 | 3.0.4 |
sinatra RubyGems | From 3.0 | 3.0.4 |
Linux distribution packages (31)
pcs AlmaLinux:8 | All versions | 0.10.14-5.el8_7.2.alma |
pcs-snmp AlmaLinux:8 | All versions | 0.10.14-5.el8_7.2.alma |
pcs AlmaLinux:9 | All versions | 0.11.3-4.el9_1.2 |
pcs-snmp AlmaLinux:9 | All versions | 0.11.3-4.el9_1.2 |
pcs Red Hat:enterprise_linux:8::highavailability | All versions | 0:0.10.14-5.el8_7.2 |
pcs-snmp Red Hat:enterprise_linux:8::highavailability | All versions | 0:0.10.14-5.el8_7.2 |
pcs Red Hat:enterprise_linux:8::resilientstorage | All versions | 0:0.10.14-5.el8_7.2 |
pcs-snmp Red Hat:enterprise_linux:8::resilientstorage | All versions | 0:0.10.14-5.el8_7.2 |
pcs Red Hat:enterprise_linux:9::highavailability | All versions | 0:0.11.3-4.el9_1.2 |
pcs-snmp Red Hat:enterprise_linux:9::highavailability | All versions | 0:0.11.3-4.el9_1.2 |
pcs Red Hat:enterprise_linux:9::resilientstorage | All versions | 0:0.11.3-4.el9_1.2 |
pcs-snmp Red Hat:enterprise_linux:9::resilientstorage | All versions | 0:0.11.3-4.el9_1.2 |
pcs Red Hat:rhel_e4s:8.1::highavailability | All versions | 0:0.10.2-4.el8_1.3 |
pcs-snmp Red Hat:rhel_e4s:8.1::highavailability | All versions | 0:0.10.2-4.el8_1.3 |
pcs Red Hat:rhel_e4s:8.2::highavailability | All versions | 0:0.10.4-6.el8_2.4 |
pcs-snmp Red Hat:rhel_e4s:8.2::highavailability | All versions | 0:0.10.4-6.el8_2.4 |
pcs Red Hat:rhel_eus:8.4::highavailability | All versions | 0:0.10.8-1.el8_4.3 |
pcs-snmp Red Hat:rhel_eus:8.4::highavailability | All versions | 0:0.10.8-1.el8_4.3 |
pcs Red Hat:rhel_eus:8.4::resilientstorage | All versions | 0:0.10.8-1.el8_4.3 |
pcs-snmp Red Hat:rhel_eus:8.4::resilientstorage | All versions | 0:0.10.8-1.el8_4.3 |
pcs Red Hat:rhel_eus:8.6::highavailability | All versions | 0:0.10.12-6.el8_6.3 |
pcs-snmp Red Hat:rhel_eus:8.6::highavailability | All versions | 0:0.10.12-6.el8_6.3 |
pcs Red Hat:rhel_eus:8.6::resilientstorage | All versions | 0:0.10.12-6.el8_6.3 |
pcs-snmp Red Hat:rhel_eus:8.6::resilientstorage | All versions | 0:0.10.12-6.el8_6.3 |
pcs Red Hat:rhel_eus:9.0::highavailability | All versions | 0:0.11.1-10.el9_0.3 |
pcs-snmp Red Hat:rhel_eus:9.0::highavailability | All versions | 0:0.11.1-10.el9_0.3 |
pcs Red Hat:rhel_eus:9.0::resilientstorage | All versions | 0:0.11.1-10.el9_0.3 |
pcs-snmp Red Hat:rhel_eus:9.0::resilientstorage | All versions | 0:0.11.1-10.el9_0.3 |
pcs Red Hat:rhel_tus:8.2::highavailability | All versions | 0:0.10.4-6.el8_2.4 |
pcs-snmp Red Hat:rhel_tus:8.2::highavailability | All versions | 0:0.10.4-6.el8_2.4 |
pcs Rocky Linux:8 | All versions | 0:0.10.14-5.el8_7.2 |
Products include Debian Debian Linux, Sinatrarb Sinatra.
How do I fix CVE-2022-45442?
Upgrade sinatra to a fixed version for your release line: 2.2.3 or 3.0.4.
Is CVE-2022-45442 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-45442 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2023:0855, ALSA-2023:0974, DEBIAN-CVE-2022-45442, DLA-3264-1, GHSA-2x8x-jmrp-phxw, MGASA-2023-0029 and 14 more.