Cyber Resilience

CVE-2022-1813

CriticalPublic PoCRCE

Published: 22 May 2022

Published
22 May 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1136 93.7th percentile
Risk Priority 26 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-1813 is a critical-severity OS Command Injection (CWE-78) vulnerability in Rengine Project Rengine. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 6.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2022-1813 is an OS command injection vulnerability, tracked as CWE-78, that affects the yogeshojha/rengine reconnaissance framework in all versions prior to 1.2.0. The flaw resides in code paths that pass unsanitized user input directly into operating-system command execution, enabling an attacker to run arbitrary shell commands on the underlying host.

The vulnerability is remotely exploitable without authentication or user interaction over the network. An unauthenticated attacker can supply crafted input that results in full system compromise, including the ability to read, modify, or delete data and to execute code with the privileges of the reNgine process.

The referenced GitHub commit (8277cec0f008a0451371a92e7e0bf082ab3f0c34) and the associated huntr.dev disclosure both point to the corrective change that was merged to produce version 1.2.0. Administrators should upgrade to 1.2.0 or later; no other mitigations such as configuration changes or workarounds are documented in the available references.

The EPSS score has remained flat at 0.1136 with no material post-disclosure increase.

EU & UK References

Vulnerability details

OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

rengine project
rengine
≤ 1.2.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References