CVE-2022-37703

EIP tracks 1 public exploit for CVE-2022-37703. PoCs published by MaherAzzouzi.

AI-analyzed exploit summary The repository describes an information disclosure vulnerability in Amanda 3.5.1's calcsize SUID binary, where an attacker can check the existence of arbitrary directories via `opendir()` without proper path validation. The PoC involves running the binary with specific arguments to infer directory existence based on error output.

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.