CVE-2022-4611
MEDIUMClick Studios Passwordstate - Hard-Coded Credentials
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2022-4611. PoCs published by Phamchie, fgsoftware1.
AI-analyzed exploit summary This PoC exploits CVE-2022-4611 by sending a malformed HTTP request with an oversized 'X-Data' header to trigger a buffer overflow. It establishes a socket connection to the target host and port, sends the crafted payload, and attempts to receive a response.
Description
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216273 was assigned to this vulnerability.
Exploits (2)
This PoC exploits CVE-2022-4611 by sending a malformed HTTP request with an oversized 'X-Data' header to trigger a buffer overflow. It establishes a socket connection to the target host and port, sends the crafted payload, and attempts to receive a response.
This Go-based PoC exploits CVE-2022-4611 by sending a crafted HTTP request with a long 'X-Data' header to trigger a buffer overflow, followed by a TCP socket connection to check for output. It targets a vulnerability in an unspecified software, likely a web server or service.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N