CVE-2022-31793 (GCVE-0-2022-31793)

Vulnerability from cvelistv5 – Published: 2022-08-04 21:55 – Updated: 2024-08-03 07:26
VLAI?
Summary
do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.085Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/495801"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://inglorion.net/software/muhttpd/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://kb.cert.org/vuls/id/495801"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://derekabdine.com/blog/2022-arris-advisory"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-04T21:55:05",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://inglorion.net/software/muhttpd/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://kb.cert.org/vuls/id/495801"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://derekabdine.com/blog/2022-arris-advisory"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-31793",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://inglorion.net/software/muhttpd/",
              "refsource": "MISC",
              "url": "http://inglorion.net/software/muhttpd/"
            },
            {
              "name": "https://kb.cert.org/vuls/id/495801",
              "refsource": "MISC",
              "url": "https://kb.cert.org/vuls/id/495801"
            },
            {
              "name": "https://derekabdine.com/blog/2022-arris-advisory",
              "refsource": "MISC",
              "url": "https://derekabdine.com/blog/2022-arris-advisory"
            },
            {
              "name": "https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/",
              "refsource": "MISC",
              "url": "https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-31793",
    "datePublished": "2022-08-04T21:55:05",
    "dateReserved": "2022-05-27T00:00:00",
    "dateUpdated": "2024-08-03T07:26:01.085Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:inglorion:muhttpd:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.1.7\", \"matchCriteriaId\": \"CEA107B5-A8F4-4E3E-848B-4D3D986AC0F6\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arris:nvg443_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D540A232-E544-4289-9857-EB7D599F643B\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arris:nvg443:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D323BE0D-6E3C-43D0-870E-3C2A92F6EECF\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arris:nvg599_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2154F328-30A8-4363-B469-F5306A07FBCF\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arris:nvg599:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0677CA25-F914-48FE-8B85-F91776CEB329\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arris:nvg589_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CAEA6113-6B67-40C2-B31A-8C170854EFBE\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arris:nvg589:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"03AAE6AE-044C-44DC-8CCA-FF3D646ED19F\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arris:nvg510_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C18211F5-A1DF-40A6-8D4D-D0FD719F4039\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arris:nvg510:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EB87F9D2-CB6F-4E6F-87DA-AFDAAF8BD13C\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arris:bgw210_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E428B978-B24B-44BF-BCE9-A394793FCBB9\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arris:bgw210:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E12A518A-A94B-48F4-9C8B-D24A8D0F16EE\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arris:bgw320_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"24130786-8DD0-415E-A3D3-F57566F3ADA2\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arris:bgw320:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1B033E94-8EA8-4A9D-A8EC-1EE1FFA1BC4D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.\"}, {\"lang\": \"es\", \"value\": \"La funci\\u00f3n do_request en el archivo request.c en muhttpd versiones anteriores a 1.1.7, permite a atacantes remotos leer archivos arbitrarios al construir una URL con un solo car\\u00e1cter antes de una ruta deseada en el sistema de archivos. Esto ocurre porque el c\\u00f3digo salta el primer car\\u00e1cter cuando sirve archivos. Los dispositivos Arris NVG443, NVG599, NVG589 y NVG510 y los dispositivos derivados de Arris BGW210 y BGW320 est\\u00e1n afectados\"}]",
      "id": "CVE-2022-31793",
      "lastModified": "2024-11-21T07:05:20.330",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2022-08-04T22:15:08.017",
      "references": "[{\"url\": \"http://inglorion.net/software/muhttpd/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://derekabdine.com/blog/2022-arris-advisory\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://kb.cert.org/vuls/id/495801\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"http://inglorion.net/software/muhttpd/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://derekabdine.com/blog/2022-arris-advisory\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://kb.cert.org/vuls/id/495801\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"https://www.kb.cert.org/vuls/id/495801\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-31793\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2022-08-04T22:15:08.017\",\"lastModified\":\"2024-11-21T07:05:20.330\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.\"},{\"lang\":\"es\",\"value\":\"La funci\u00f3n do_request en el archivo request.c en muhttpd versiones anteriores a 1.1.7, permite a atacantes remotos leer archivos arbitrarios al construir una URL con un solo car\u00e1cter antes de una ruta deseada en el sistema de archivos. Esto ocurre porque el c\u00f3digo salta el primer car\u00e1cter cuando sirve archivos. Los dispositivos Arris NVG443, NVG599, NVG589 y NVG510 y los dispositivos derivados de Arris BGW210 y BGW320 est\u00e1n afectados\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:inglorion:muhttpd:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.1.7\",\"matchCriteriaId\":\"CEA107B5-A8F4-4E3E-848B-4D3D986AC0F6\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arris:nvg443_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D540A232-E544-4289-9857-EB7D599F643B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arris:nvg443:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D323BE0D-6E3C-43D0-870E-3C2A92F6EECF\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arris:nvg599_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2154F328-30A8-4363-B469-F5306A07FBCF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arris:nvg599:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0677CA25-F914-48FE-8B85-F91776CEB329\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arris:nvg589_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAEA6113-6B67-40C2-B31A-8C170854EFBE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arris:nvg589:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"03AAE6AE-044C-44DC-8CCA-FF3D646ED19F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arris:nvg510_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C18211F5-A1DF-40A6-8D4D-D0FD719F4039\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arris:nvg510:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB87F9D2-CB6F-4E6F-87DA-AFDAAF8BD13C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arris:bgw210_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E428B978-B24B-44BF-BCE9-A394793FCBB9\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arris:bgw210:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E12A518A-A94B-48F4-9C8B-D24A8D0F16EE\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arris:bgw320_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"24130786-8DD0-415E-A3D3-F57566F3ADA2\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arris:bgw320:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1B033E94-8EA8-4A9D-A8EC-1EE1FFA1BC4D\"}]}]}],\"references\":[{\"url\":\"http://inglorion.net/software/muhttpd/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://derekabdine.com/blog/2022-arris-advisory\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://kb.cert.org/vuls/id/495801\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"http://inglorion.net/software/muhttpd/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://derekabdine.com/blog/2022-arris-advisory\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://kb.cert.org/vuls/id/495801\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.kb.cert.org/vuls/id/495801\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.