Appalti & Contratti 9.12.2 LFS/DL229 WEB-INF/web.xml file inclusion

Summaryinfo

A vulnerability categorized as problematic has been discovered in Appalti & Contratti 9.12.2. This impacts an unknown function of the file WEB-INF/web.xml of the component LFS/DL229. Such manipulation leads to file inclusion. This vulnerability is traded as CVE-2022-44784. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Appalti & Contratti 9.12.2 and classified as problematic. Affected by this issue is an unknown functionality of the file WEB-INF/web.xml of the component LFS/DL229. The manipulation with an unknown input leads to a file inclusion vulnerability. Using CWE to declare the problem leads to CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. Impacted is confidentiality. CVE summarizes:

An issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of services provided by the Axis 1.4 instance, embedded directly into the applications, as hinted by the WEB-INF/web.xml file leaked through Local File Inclusion. Among the exposed services, there is the Axis AdminService, which, through the default configuration, should normally be accessible only by the localhost. Nevertheless, by trying to access the mentioned service, both in LFS and DL229, the service can actually be reached even by remote users, allowing creation of arbitrary services on the server side. When an attacker can reach the AdminService, they can use it to instantiate arbitrary services on the server. The exploit procedure is well known and described in Generic AXIS-SSRF exploitation. Basically, the attack consists of writing a JSP page inside the root directory of the web application, through the org.apache.axis.handlers.LogHandler class.

The weakness was shared 11/22/2022. The advisory is shared for download at members.backbox.org. This vulnerability is handled as CVE-2022-44784 since 11/07/2022. There are known technical details, but no exploit is available.

By approaching the search of inurl:WEB-INF/web.xml it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Appalti & Contratti

Version

• 9.12.2

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion