IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

IBM Aspera Faspex versions before 4.4.2 patch level 2 suffer from a YAML deserialization issue. By crafting a specific payload on a specific API path, a remote and unauthenticated attacker can achieve remote code execution on the target instance.

According to its self-reported version, the instance of IBM Aspera Faspex running on the remote web server is prior to 4.4.2 Patch Level 2. It is, therefore, affected by multiple vulnerabilities, including:

    - IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the       system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could       exploit this vulnerability to execute arbitrary code on the system. (CVE-2022-47986)

    - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant       matches. (CVE-2018-25032)

    - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache       HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. (CVE-2022-26377)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
114275	IBM Aspera Faspex < 4.4.2 PL2 Remote Code Execution	Web App Scanning	Component Vulnerability	Check Based	critical
173033	IBM Aspera Faspex < 4.4.2 Patch Level 2 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2022-47986

critical

Tenable Plugins

critical

critical