Lucene search

INCIBECVE-2022-1561

HistoryAug 01, 2022 - 1:15 p.m.

CVE-2022-1561

2022-08-0113:15:09

CWE-471

INCIBE

web.nvd.nist.gov

cve-2022-1561

lura

krakend

url parameters

security vulnerability

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.

Affected configurations

Nvd

Vulners

Node

krakendkrakendRange<2.0.0enterprise

krakendkrakendRange≤2.0.2community

luraprojectluraRange<2.0.2

VendorProductVersionCPE
krakendkrakend*cpe:2.3:a:krakend:krakend:*:*:*:*:enterprise:*:*:*
krakendkrakend*cpe:2.3:a:krakend:krakend:*:*:*:*:community:*:*:*
luraprojectlura*cpe:2.3:a:luraproject:lura:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
krakend	krakend	*	cpe:2.3:a:krakend:krakend:::::enterprise:::*
krakend	krakend	*	cpe:2.3:a:krakend:krakend:::::community:::*
luraproject	lura	*	cpe:2.3:a:luraproject:lura::::::::

CNA Affected

[
  {
    "product": "Lura Project",
    "vendor": "KrakenD",
    "versions": [
      {
        "lessThan": "v2.0.2",
        "status": "affected",
        "version": "v2.0.2",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "KrakenD-CE",
    "vendor": "KrakenD",
    "versions": [
      {
        "lessThan": "v2.0.2",
        "status": "affected",
        "version": "v2.0.2",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "KrakenD-EE",
    "vendor": "KrakenD",
    "versions": [
      {
        "lessThan": "v2.0.0",
        "status": "affected",
        "version": "v2.0.0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.incibe-cert.es/en/early-warning/security-advisories/crafted-backend-urls-lura-project

www.krakend.io/blog/cve-2022-1561-crafted-backend-urls/

Social References

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

Related for CVE-2022-1561