IBM · Aspera Faspex
IBM Aspera Faspex versions 4.4.2 Patch Level 1 and earlier contain a YAML deserialization flaw that allows arbitrary code execution on the system. An unauthenticated remote attacker with network access can exploit it without user interaction by sending a specially crafted call to an obsolete API endpoint, which was removed in Faspex 4.4.2 PL2.
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
First seen exploited 4 days before it was disclosed. Public exploit code (PoC-in-GitHub) was available 14 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Remote exploit of public-facing application via API
By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability
Arbitrary code execution resulting from deserialization
could allow a remote attacker to execute arbitrary code on the system
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2022-47986 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
IBM Aspera Faspex affected by CVE-2022-47986: Organizations can remediate CVE-2022-47986 by upgrading to Faspex 4.4.2 Patch Level 2 or using Faspex 5.x which does not contain this vulnerability.
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.