CVE-2022-37331

Executive Summary

CVE-2022-37331 is an out-of-bounds write vulnerability in Open Babel 3.1.1 and master commit 530dbfa3, specifically within the Gaussian format orientation functionality. A specially crafted malformed file can trigger arbitrary code execution when processed by an unsuspecting user. The vulnerability carries a CVSS score of 7.3, indicating high severity, and is currently unpatched with no vendor fix released. Organizations using Open Babel for cheminformatics file conversion should treat any untrusted molecule files as potential attack vectors.

Technical Analysis

Open Babel is a widely used open-source chemical toolbox designed to interconvert molecular file formats, including Gaussian, MOL, SDF, and others. The vulnerability exists specifically in the Gaussian format orientation functionality. Gaussian is a computational chemistry software package, and its format files (.gjf, .log, .cart) contain molecular coordinates, atomic numbers, and orientation data.

The underlying vulnerability class is an out-of-bounds write (CWE-787). When Open Babel parses a Gaussian-format file, it processes orientation block data — which typically contains atomic coordinates and vector information. The parsing logic fails to properly validate the bounds of input data before writing to a memory buffer. A malformed file that declares more orientation data points than the allocated buffer can accommodate will cause the parser to write beyond the buffer's boundaries.

The attack surface is the file parser itself. Any application that invokes Open Babel to process untrusted input is vulnerable. Typical usage includes:

• Command-line conversion utilities (obabel binary)
• GUI applications using Open Babel libraries
• Web services that accept uploaded molecule files for conversion or analysis
• Automated batch processing pipelines in research environments

Insufficient technical detail is available regarding the specific function names or exact code paths involved. The NVD description confirms the vulnerability exists in Gaussian orientation handling but does not provide deeper implementation specifics.

The out-of-bounds write can corrupt heap metadata, leading to memory corruption conditions such as segmentation faults or, when carefully orchestrated, arbitrary code execution. The severity is elevated because the write occurs during file parsing, a common entry point for untrusted data.

Exploitation Scenarios

Step 1 — Reconnaissance/Target Identification: An attacker identifies systems running Open Babel versions 3.1.1 or the affected master commit (530dbfa3). Targets include research institutions, pharmaceutical companies, chemical database services, and academic clusters that process molecule files. Attackers may use SHODAN queries for exposed web interfaces that invoke Open Babel, or they may target specific organizations through social engineering to deliver a malicious file directly.

Step 2 — Flaw Triggering: The attacker crafts a Gaussian-format file with malformed orientation data. This can be done by taking a valid Gaussian file and corrupting the orientation block header — for example, declaring a larger number of atoms or orientation frames than the rest of the file actually contains, or embedding oversized coordinate arrays. When a victim opens this file via a GUI or passes it to the obabel command-line tool for conversion, the Gaussian parser begins processing the orientation data without adequate bounds checking.

Step 3 — Payload/Execution Method: Since no public PoC exists, exploitation specifics remain at the vulnerability-class level. For a heap-based out-of-bounds write, a typical attack chain involves:

• Heap spraying to position controlled data near the target buffer
• Crafting the malformed file so that the out-of-bounds write overwrites adjacent heap metadata (e.g., chunk headers, vtable pointers, or function pointers)
• Overwriting a return address or a function pointer to redirect execution to shellcode or a ROP chain embedded in the file data

The write primitive is achieved when the parser copies coordinate values (floating-point data) beyond the allocated buffer boundary. Because the data being written is largely attacker-controlled within the bounds of float representation, an attacker can manipulate the write contents.

Step 4 — Post-Exploitation Impact: Successful exploitation yields arbitrary code execution in the context of the user or service running Open Babel. For a service context, this could mean full compromise of the web application, access to the underlying server, and lateral movement into connected research databases. For a desktop user, this could mean credential theft, data exfiltration, or pivot to other internal systems.

The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local attack vector (the attacker must deliver a file to the victim), no privileges required, and user interaction via opening the malicious file. The scope is unchanged but the confidentiality, integrity, and availability impacts are all rated high.

Impact Assessment

Business Impact:

For organizations in pharmaceutical research, materials science, and computational chemistry, Open Babel is an indispensable tool. An exploitable flaw in the file parser creates a vector for supply-chain-style attacks where a single malicious molecule file can compromise an entire research workstation or server. The out-of-bounds write allows full arbitrary code execution, meaning the attacker gains the same privileges as the user or service processing the file.

Affected Systems:

• All installations of Open Babel 3.1.1 (stable release)
• Master development branch as of commit 530dbfa3
• Any downstream applications statically linking Open Babel or bundling it in their own distributions (e.g., PyBEL derivatives, KNIME nodes, command-line tools in research pipelines)

Blast Radius:

• CVSS 7.3 (High)
• No CISA KEV listing, no known in-the-wild exploitation, and EPSS score of 0.00681 (49.2% percentile) indicates low imminent exploitation likelihood
• However, exploitation potential is high because the vulnerability is unpatched and the software is widely distributed in scientific communities

Confidentiality impact: An attacker can read arbitrary files and exfiltrate research data.

Integrity impact: An attacker can modify files, inject backdoors into research outputs, or alter computation results.

Availability impact: An attacker can crash the application or use the code execution to corrupt data or install malware that degrades system performance.

Detection Guidance

Sigma Rule

title: Open Babel Gaussian Format Out-of-Bounds Write Exploitation Attempt
id: 6f8a4b2c-3d11-4e5f-9ab1-c7d2e3f4a5b6
status: experimental
description: Detects abnormal process behavior when Open Babel parses Gaussian files, potentially indicating CVE-2022-37331 exploitation.
author: Valtersit Threat Intelligence
date: 2024/01/17
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\obabel.exe'
            - '\obabel.exe'
        CommandLine|contains|all:
            - '.gjf'
            - '-o'
        CommandLine|contains:
            - '.log'
            - '.xyz'
    filter_benign:
        CommandLine|contains:
            - '--help'
            - '--version'
    condition: selection and not filter_benign
falsepositives:
    - Legitimate batch conversion of Gaussian files by researchers
    - Automated pipeline scripts converting many files
level: medium
tags:
    - attack.t1203
    - cve.2022-37331

YARA Rule

rule OpenBabel_Gaussian_OOBW_CVE_2022_37331
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malformed Gaussian format files targeting the orientation parsing vulnerability in Open Babel 3.1.1"
        date = "2024-01-17"
        cve = "CVE-2022-37331"
        score = 60
    strings:
        $gauss_marker = "#p"
        $gauss_orient = "Standard orientation:"
        $gauss_frame = "Coordinates (Angstroms)"
        $gauss_zmatrix = "Z-Matrix orientation:"
        $large_count1 = /[0-9]{5,}/  // suspiciously large atomic indices
        $large_coord = /[+-]?\d+\.\d{10,}/  // excessively precise coordinates
    condition:
        any of ($gauss_*) and 
        (any of them) and
        (#large_count1 > 3) and
        filesize < 10MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Open Babel Gaussian Orientation OOB Write Attempt (CVE-2022-37331)"; flow:established,to_server; content:"Content-Type|3a| multipart/form-data"; http_header; content:".gjf"; http_uri; content:"filename=\""; http_client_body; within:200; pcre:"/(Standard orientation:|Z-Matrix orientation:)/"; sid:2024017; rev:1; metadata:attack_target Client_Endpoint, created_at 2024_01_17, cve CVE_2022_37331, deployment Perimeter, signature_severity Major, tag Exploit_Kit;)

Elastic Detection

sequence by process.pid with maxspan=1s
  [network where process.name == "obabel.exe" and event.action == "connection_attempted"]
  [file where event.action == "write" and 
   (file.extension == "gjf" or file.extension == "log" or file.extension == "xyz") and
   process.name == "obabel.exe"]
  [process where event.action == "exec" and 
   process.parent.name == "obabel.exe"]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Application
| search (EventCode=1000 OR EventCode=1001 OR EventCode=1005)
| where Image="*obabel.exe*" OR CommandLine="*obabel*"
| table _time, Computer, Image, CommandLine, FaultingModule
| stats count by Image, CommandLine

Alternative network-based query:

index=firewall OR index=proxy
| search "*.gjf" OR "*.log"
| where src NOT IN [known_trusted_scanners]
| search (uploads OR POST OR PUT)
| table _time, src_ip, dest_ip, url, bytes_out, user

Wazuh OSSEC Rule

<group name="cisco">
    <rule id="100217" level="12">
        <if_sid>5000, 5001</if_sid>
        <program_name>obabel|openbabel|obabel.exe</program_name>
        <description>Open Babel Gaussian format parsing attempt detected - potential CVE-2022-37331 exploitation</description>
        <group>openbabel,vulnerability,CVE-2022-37331,</group>
        <mitre>
            <id>T1203</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The vendor fix is confirmed as N/A, and no source has reported a remediation commit.

1) Immediate Mitigations:

• If safe to do so, restrict or block all processing of Gaussian format files (.gjf, .log, .cart) until a patch becomes available
• Implement strict file validation before passing files to Open Babel — check file size, verify structure, limit file dimensions (atom count, coordinate ranges)
• Run Open Babel in a sandboxed environment (Docker container, VMWare, or gVisor with no network access) so that any successful exploit is contained
• Use a file conversion service that abstracts Open Babel calls and performs validation prior to parsing
• If file processing is mandatory, perform it in isolated containers or VMs with limited privileges

2) Patch/Upgrade Steps:

• Monitor the Open Babel GitHub repository (github.com/openbabel/openbabel) for commits addressing Gaussian orientation parsing
• When a patched release (expected as 3.1.2 or later) is available, upgrade immediately
• The master branch commit 530dbfa3 should be replaced with a commit that includes the fix — verify the checkout hash before rebuilding
• Rebuild any downstream tools or applications that statically link Open Babel with the patched version

3) Long-Term Hardening:

• Maintain an allowlist of known-valid file formats and structure schemas for cheminformatics tools
• Integrate Open Babel file parsing with multiprocessing isolation — each file parse in its own process with a watchdog timeout
• Implement integrity monitoring on systems running Open Babel — alert on unexpected file writes or memory corruption signals (crash dumps, access violations)
• For web-facing conversion services, apply Web Application Firewall rules to block multipart uploads containing suspicious Gaussian content
• Document this CVE in internal threat modeling and require annual validation that no unpatched nodes run legacy versions

References

1. NVD Entry for CVE-2022-37331 — https://nvd.nist.gov/vuln/detail/CVE-2022-37331 (NVD Description, CVSS 7.3, EPSS data)

2. Open Babel Official Repository — https://github.com/openbabel/openbabel (Monitor for future patches and release notes addressing this CVE)

3. Open Babel Official Website — https://openbabel.org/ (Product information, download links, changelog)

4. CWE-787: Out-of-bounds Write — https://cwe.mitre.org/data/definitions/787.html (Vulnerability class reference)

5. MITRE ATT&CK Technique T1203 — https://attack.mitre.org/techniques/T1203/ (Exploitation for Client-Side Execution — attack technique classification)

Threat Actor Activity: No known in-the-wild exploitation has been observed or reported. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. Exploit code availability is UNKNOWN; no public PoC has been disclosed. The combination of an unpatched state and no available exploit code makes this a latent risk requiring active monitoring.