.. / CVE-2022-47986

• RCE
• Nuclei
• Web

Exploit for IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution (CVE-2022-47986)

Description:

IBM Aspera Faspex through 4.4.2 Patch Level 1 is susceptible to remote code execution via a YAML deserialization flaw. This can allow an attacker to send a specially crafted obsolete API call and thereby execute arbitrary code, obtain sensitive data, and/or execute other unauthorized operations.

Nuclei Template

View the template here CVE-2022-47986.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-47986.yaml

References: