CVE-2022-41412

Related Files

perfSONAR 4.4.4 Open Proxy / Relay

Posted Nov 30, 2022

Authored by Ryan Moore | Site github.com

perfSONAR bundles with it a graphData.cgi script, used to graph and visualize data. There is a flaw in graphData.cgi allowing for unauthenticated users to proxy and relay HTTP/HTTPS traffic through the perfSONAR server. The vulnerability can potentially be leveraged to exfiltrate or enumerate data from internal web servers. This vulnerability was patched in perfSONAR version 4.4.5. Versions 4.x through 4.4.4 are affected. There is a whitelisting function that will mitigate, but is disabled by default.

tags | exploit, web, cgi

advisories | CVE-2022-41412

SHA-256 | 57258cc3a50359f248bba303d6a0892af6f77e5cbd93340c72b5018222e14550

Download | Favorite | View