Rapid7 Nexpose/InsightVM up to 6.6.177 HTTPS Endpoint certificate validation

Summaryinfo

A vulnerability has been found in Rapid7 Nexpose and InsightVM up to 6.6.177 and classified as critical. Affected is an unknown function of the component HTTPS Endpoint. Performing a manipulation results in certificate validation. This vulnerability is cataloged as CVE-2022-3913. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in Rapid7 Nexpose and InsightVM up to 6.6.177. This affects an unknown part of the component HTTPS Endpoint. The manipulation with an unknown input leads to a certificate validation vulnerability. CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177 fail to validate the certificate of the update server when downloading updates. This failure could allow an attacker in a privileged position on the network to provide their own HTTPS endpoint, or intercept communications to the legitimate endpoint. The attacker would need some pre-existing access to at least one node on the network path between the Rapid7-controlled update server and the Nexpose/InsightVM application, and the ability to either spoof the update server's FQDN or redirect legitimate traffic to the attacker's server in order to exploit this vulnerability. Note that even in this scenario, an attacker could not normally replace an update package with a malicious package, since the update process validates a separate, code-signing certificate, distinct from the HTTPS certificate used for communication. This issue was resolved on February 1, 2023 in update 6.6.178 of Nexpose and InsightVM.

The weakness was shared 02/02/2023. It is possible to read the advisory at rapid7.com. This vulnerability is uniquely identified as CVE-2022-3913 since 11/09/2022. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1587.003 according to MITRE ATT&CK.

Upgrading to version 6.6.178 eliminates this vulnerability. The upgrade is hosted for download at docs.rapid7.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Rapid7

Name

• InsightVM
• Nexpose

Version

• 6.6.177

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion