CVE-2022-45047
Published: 16 November 2022
Summary
CVE-2022-45047 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Apache Sshd. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Apache MINA SSHD versions up to and including 2.9.1 contain a deserialization flaw in the SimpleGeneratorHostKeyProvider class, which loads host keys for SSH servers by deserializing a java.security.PrivateKey object. This class is one of several key-provider implementations available to applications that embed the library. The issue is tracked as CWE-502 and carries a CVSS 3.1 score of 9.8.
An unauthenticated remote attacker can supply a malicious serialized object over the network and trigger its processing during host-key initialization. Successful exploitation grants arbitrary code execution with the privileges of the SSH server process, resulting in full confidentiality, integrity, and availability impact.
NetApp has published advisory NTAP-20240216-0008 referencing the issue, and the Apache MINA development list contains related discussion at the provided archive links; operators should consult these sources and upgrade to a corrected MINA SSHD release. The associated EPSS score has remained flat at 0.0599 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-7328
Vulnerability details
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH…
more
server.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.