Bug 2144748 (CVE-2022-4116)

Summary:	CVE-2022-4116 quarkus_dev_ui: Dev UI Config Editor is vulnerable to drive-by localhost attacks leading to RCE
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anstephe, avibelli, bgeorges, chazlett, clement.escoffier, dandread, dkreling, gsmet, hamadhan, jwon, lthon, max.andersen, peholase, pgallagh, pjindal, probinso, rruss, rsvoboda, sbiarozk, sdouglas
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in quarkus. This issue occurs in Dev UI Config Editor, which is vulnerable to drive-by localhost attacks leading to remote code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-14 06:48:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2144749

Description Sandipan Roy 2022-11-22 08:15:00 UTC

Dev UI Config Editor is vulnerable to drive-by localhost attacks leading to RCE

Comment 2 Paramvir jindal 2022-12-01 14:37:40 UTC

Adjusting CVSS score:
Attack complexity should be High and User Interaction should be Required because Developer himself has to go to malicious website in order for the attack to take place.

Also this affects only the development environment and not the actual production and hence the impact as considered as Important at max.

Comment 3 errata-xmlrpc 2022-12-13 13:20:51 UTC

This issue has been addressed in the following products:

  Red Hat build of Quarkus Platform 2.7.6.SP3

Via RHSA-2022:8957 https://access.redhat.com/errata/RHSA-2022:8957

Comment 4 Product Security DevOps Team 2022-12-14 06:48:31 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-4116

Comment 5 errata-xmlrpc 2022-12-14 13:15:31 UTC

This issue has been addressed in the following products:

  Red Hat build of Quarkus 2.13.5

Via RHSA-2022:9023 https://access.redhat.com/errata/RHSA-2022:9023