CVE-2022-43467

Executive Summary

CVE-2022-43467 is a critical out-of-bounds write vulnerability in Open Babel 3.1.1 and master commit 530dbfa3, specifically in the PQS format coord_file functionality. Successful exploitation allows an attacker to achieve arbitrary code execution by providing a specially crafted malformed file, with a CVSS score of 9.8. Any system or application that parses untrusted PQS files—whether via command-line tools, library integrations, or web services—is exposed to potential compromise.

The vulnerability requires no authentication and can be triggered by a victim opening a malicious file, making it particularly dangerous in automated processing pipelines and file-sharing environments. With no patch currently available and no known mitigations from the vendor, affected organizations must rely on compensating controls and file-handling isolation.

Technical Analysis

Open Babel is a widely used open-source cheminformatics toolbox that converts between over 100 chemical file formats, including PQS (Parallel Quantum Solutions) files. The vulnerability exists in the PQS format coord_file functionality, which is responsible for parsing coordinate data from PQS files. This parsing functionality is implemented in the C++ codebase and is called whenever a PQS file is processed.

The flaw is an out-of-bounds write (CWE-787), a memory safety violation where the program writes data beyond the allocated buffer boundaries. In the context of coord_file parsing, this typically occurs when the parser reads coordinate records from the file and writes them into a fixed-size or improperly size-checked buffer without verifying that the amount of data being written fits within the allocated memory region.

The out-of-bounds write is triggered by a specially crafted malformed PQS file. An attacker can manipulate the file's coordinate count, field widths, or other structural elements to cause the parser to write beyond the intended buffer boundary. In a typical exploit scenario, this memory corruption can be leveraged to overwrite adjacent memory structures—such as function pointers, return addresses, or heap metadata—leading to arbitrary code execution.

Open Babel's architecture makes this vulnerability particularly dangerous because the core parsing library is embedded in numerous downstream applications, including molecular visualization tools, computational chemistry pipelines, and digital library systems. Any of these applications that process user-supplied PQS files without sandboxing or validation inherits this vulnerability. Insufficient technical detail is available in the CVE description regarding the exact buffer overrun mechanism; however, the out-of-bounds write classification and the "specially crafted malformed file" trigger indicate a classic file-format parser overflow.

Exploitation Scenarios

The attack chain for CVE-2022-43467 is inferred from the vulnerability class (out-of-bounds write in a file parsers) and the CVSS vector characteristics. No public PoC is currently available; therefore, the attack chain is described at the vulnerability-class level.

Step 1 — Reconnaissance/Target Identification: An attacker identifies targets that process PQS files. These could be public web services that accept chemical file uploads, research institutions running batch processing pipelines with Open Babel, or end-user systems where a scientist might receive a PQS file. Reconnaissance may involve scanning for exposed web applications that advertise chemical file conversion capabilities or identifying research groups using Open Babel through public publications.

Step 2 — Triggering the Flaw: The attacker crafts a malformed PQS file designed to contain a write primitive that exceeds buffer boundaries in the coord_file parser. The malformed file likely contains coordinate records with inconsistent metadata—such as declaring more atoms than are actually present, or including unusually long coordinate strings—to force the parser into an out-of-bounds write. The crafted file is delivered to the victim via email attachment, file-sharing platform, or direct upload to a vulnerable web service.

Step 3 — Payload/Execution Method: Upon processing, the out-of-bounds write corrupts adjacent heap memory. The attacker must arrange the heap layout so that the overwritten memory includes a pointer that will be used post-corruption, potentially redirecting execution flow to a shellcode payload placed within the same file or in another controlled buffer. Since this is an arbitrary code execution primitive, the attacker's payload could be embedded alongside the malformed PQS data. On systems with modern exploit mitigations (ASLR, DEP, CFG), the attacker would need to chain additional techniques to bypass these protections.

Step 4 — Post-Exploitation Impact: Once arbitrary code execution is achieved, the attacker inherits the privileges of the process running the vulnerable application. In a typical workstation scenario, this would be the user's account, allowing data theft, keylogging, or lateral movement. In server-side processing pipelines, the attacker could gain access to the service account, which may have broader database or filesystem access. The attacker could also use the compromised system as a foothold for further network infiltration.

Impact Assessment

The CVSS score of 9.8 places this vulnerability in the critical severity range. Although the attack vector is network-based and requires no special privileges, the attack complexity is low, and the user interaction requirement (opening a file) is minimal. The impact extends to Confidentiality, Integrity, and Availability, all rated high, meaning full system compromise is plausible.

Open Babel is embedded in dozens of scientific software packages, including molecular editors, quantum chemistry GUIs, and automated high-throughput virtual screening platforms. Any organization in pharmaceutical R&D, academic chemistry, materials science, or biotech that uses tooling relying on Open Babel for PQS file handling is exposed. The lack of authentication requirement means that any unauthenticated user able to submit a file to a processing service can trigger the vulnerability.

The EPSS score of 0.00828 (54.1% percentile) indicates moderate to low observed exploitation activity in the wild. However, this does not diminish the risk, as the vulnerability remains unpatched, and the attack surface is large given the broad distribution of the Open Babel library. Organizations must assume that exploit development is feasible and may be underway by advanced threat actors.

Detection Guidance

Sigma Rule

title: Open Babel PQS Coordinate File Parsing Vulnerability (CVE-2022-43467) Attempt
id: 81a62ba3-4c27-4f55-938c-f4b78f5e30e1
status: experimental
description: Detects potential exploitation attempts of the out-of-bounds write in Open Babel PQS coordinate file parsing.
author: SOC Team - Valtersit
date: 2025/01/15
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/babel'
            - '/obabel'
            - 'babel.exe'
            - 'obabel.exe'
        CommandLine|contains:
            - '.pqs'
            - 'pqs'
    condition: selection
level: medium
falsepositives:
    - Legitimate use of Open Babel with non-malicious PQS files
fields:
    - CommandLine
    - Image
    - User
tags:
    - attack.t1203
    - cve.2022-43467

YARA Rule

rule CVE_2022_43467_PQS_Malformed_Coord_File {
    meta:
        author = "Valtersit SOC"
        description = "Detect malformed PQS files targeting Open Babel coord_file parser"
        date = "2025-01-15"
        severity = "critical"
        cve = "CVE-2022-43467"
    strings:
        $pqs_header1 = "PQS"
        $pqs_header2 = "$coord"
        $pqs_numeric_marker = /\d{1,3}\s+-\d+\.\d+\s+-\d+\.\d+\s+-\d+\.\d+/
        $long_coord_chain = /\d{5,}\./
        $negative_deep_marker = /-\d{4,}\.\d+/
    condition:
        (uint32(0) == 0x535150) and
        (#pqs_numeric_marker > 1000) and
        ($pqs_numeric_marker at 0 or $pqs_numeric_marker in (0..filesize/2)) and
        (filesize < 51200) and
        (
            #long_coord_chain > 10 or
            #negative_deep_marker > 10
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2022-43467 - Open Babel PQS File Processing Out-of-Bounds Write Attempt"; flow:established,to_server; file_store; fileext:"pqs"; filestore; content:"PQS"; offset:0; depth:3; pcre:"/^[A-Za-z0-9\s]{0,50}(coord|module)/m"; classtype:attempted-admin; sid:2025021; rev:1; metadata:cve,2022-43467; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2022-43467;)

Elastic Detection

// Restrict to processes that handle PQS files and flag unusual memory access patterns
sequence by process.entity_id with maxspan=10s
  [process where event.type == "start" and 
     (process.name : "babel" or process.name : "obabel") and
     process.command_line : ("*.pqs*", "*PQS*")]
  [file where event.type == "termination" and 
     file.name : ("*.pqs", "*.log") and 
     file.size > 1000000]

Splunk SPL Query

index=main sourcetype=WinEventLog:Security OR sourcetype=linux_audit 
(Image=*babel* OR Image=*obabel* OR process_name=babel OR process_name=obabel)
| search CommandLine="*.pqs" OR CommandLine="*PQS*"
| eval severity=case(
    match(CommandLine, "(-.*pqs|.*PQS)"), "high",
    true(), "informational")
| stats count by Image, CommandLine, User, severity
| where count > 5

Wazuh OSSEC Rule

<group name="open_babel,">
  <rule id="100301" level="12">
    <decoded_as>json</decoded_as>
    <field name="command">\.pqs</field>
    <field name="program">babel|obabel</field>
    <group>pqs_file_processing,</group>
    <description>Open Babel process handling PQS file - possible CVE-2022-43467 exploit attempt</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
  <rule id="100302" level="10">
    <decoded_as>json</decoded_as>
    <field name="command">.*pqs.*</field>
    <field name="program">obabel.exe|babel</field>
    <group>pqs_file_processing,</group>
    <description>Potential Open Babel PQS file processing with unusual arguments</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — no patch evidence from any tracked source. Open Babel 3.1.1 and master commit 530dbfa3 remain vulnerable as of the writing of this report.

Immediate Mitigations:

1. File Validation and Sandboxing: If your application accepts untrusted PQS files, implement strict validation before passing files to Open Babel. Reject files that exceed maximum coordinate counts, have inconsistent headers, or contain abnormally formatted numeric fields. Process PQS files in isolated containers or virtual machines with network egress restrictions to limit the blast radius of a successful exploit.
2. Access Controls: Restrict file upload capabilities to authenticated, trusted users. Where possible, refuse to process PQS files from unauthenticated sources entirely.
3. Monitoring: Deploy the detection rules above to monitor for anomalous Open Babel process invocation and file processing patterns. Raise alerts when Open Babel processes files from unusual locations or with abnormal command-line arguments.
4. Least Privilege: Run Open Babel-based services under dedicated service accounts with minimal filesystem and network permissions. Never run such services as root or Administrator.

Patch/Upgrade Steps:

1. Monitor the Open Babel GitHub repository and security announcements for a patch release addressing CVE-2022-43467.
2. When a patched version is released, perform regression testing against your existing chemical file processing workflows before deploying to production.
3. If you rely on third-party applications that embed Open Babel, contact vendors to ask when they will rebundle with a patched version of the library.

Long-Term Hardening:

1. Apply address space layout randomization (ASLR), data execution prevention (DEP), and stack canaries on all systems running Open Babel to raise the difficulty of exploitation.
2. Implement file type allowlisting that only permits processing of expected chemical file formats that are necessary for business operations.
3. Review the Open Babel codebase for other potentially vulnerable file parsers, given that a similar class of flaw may exist in the parsing of other formats.
4. Maintain an inventory of all applications that bundle or statically link Open Babel, including legacy systems, to ensure complete patching coverage when a fix becomes available.

References

1. NVD Entry for CVE-2022-43467 — https://nvd.nist.gov/vuln/detail/CVE-2022-43467
2. Open Babel Official Website — https://openbabel.org
3. Open Babel GitHub Repository — https://github.com/openbabel/openbabel
4. TALOS Vulnerability Research — The initial discovery of this vulnerability was reported via Talos Intelligence research; refer to Talos vulnerability database for additional technical details when available.
5. FIRST EPSS — EPSS Score for CVE-2022-43467 — https://www.first.org/epss/search?cve=CVE-2022-43467

Threat Actor Activity: No known threat actor campaigns targeting CVE-2022-43467 have been publicly documented as of the report date. No CISA KEV listing exists (CISA KEV: NO). Exploitation likelihood remains moderate given the EPSS percentile of 54.1%. However, the critical severity and unpatched status make this a prime candidate for weaponization in the near term, particularly in targeted attacks against research institutions and chemical industry organizations.