CVE-2022-47986
CRITICAL KEV RANSOMWARE NUCLEIIBM Aspera Faspex < 4.4.2 PL2 - Remote Code Execution via YAML Deserialization
Title source: llmExploitation Summary
CVE-2022-47986 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 21, 2023, with confirmed use in ransomware campaigns. EIP tracks 6 public exploits from researchers including Maurice Lambert, ohnonoyesyes, mauricelambert. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit leverages YAML deserialization in IBM Aspera Faspex to achieve remote code execution (RCE) by sending a crafted POST request with malicious YAML payload. The payload uses Ruby object deserialization to execute arbitrary commands via the `Kernel.eval` method.
Description
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
Exploits (6)
This exploit leverages YAML deserialization in IBM Aspera Faspex to achieve remote code execution (RCE) by sending a crafted POST request with malicious YAML payload. The payload uses Ruby object deserialization to execute arbitrary commands via the `Kernel.eval` method.
This PoC exploits CVE-2022-47986, a pre-authentication RCE vulnerability in Aspera Faspex. It leverages YAML deserialization to execute arbitrary commands via a crafted payload sent to the `/aspera/faspex/package_relay/relay_package` endpoint.
This repository contains a proof-of-concept exploit for CVE-2022-47986, which leverages YAML deserialization to achieve remote code execution (RCE) in IBM Aspera Faspex versions before 4.4.2. The exploit uses crafted YAML payloads to trigger arbitrary command execution via Ruby's `Kernel.eval` method.
The repository contains only a README.md file with the CVE identifier and no exploit code or technical details. It appears to be a placeholder or incomplete submission.
The repository contains a functional exploit for CVE-2022-47986, targeting an IBM WebSphere vulnerability. The code includes AJP protocol manipulation for remote code execution (RCE) and is accompanied by weaponized scripts for automation.
The repository contains a functional exploit for CVE-2022-47986, a pre-authentication remote code execution vulnerability in Aspera Faspex. The exploit leverages YAML deserialization to achieve arbitrary command execution via a crafted payload sent to the `/aspera/faspex/package_relay/relay_package` endpoint.
Nuclei Templates (1)
html:"Aspera Faspex" || cpe:"cpe:2.3:o:linux:linux_kernel"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H