CVE-2022-43607

Executive Summary

CVE-2022-43607 is an out-of-bounds write vulnerability in the MOL2 format attribute and value handling functionality of Open Babel 3.1.1 and master commit 530dbfa3. The flaw exists in the parsing of MOL2 molecular structure files, where a specially crafted malformed file can trigger memory corruption leading to arbitrary code execution. Affected systems include any deployment of Open Babel that processes untrusted MOL2 files, including cheminformatics pipelines, web services, and research environments that accept user-supplied molecular data. Successful exploitation could allow an attacker to execute arbitrary code in the context of the Open Babel process, potentially leading to full system compromise of the affected host.

Technical Analysis

The vulnerability resides in the MOL2 file format parsing logic of Open Babel, specifically within the attribute and value functionality. MOL2 (Tripos Mol2) is a widely used molecular file format in computational chemistry that describes atomic coordinates, bond information, and molecular properties through structured text fields. The format includes an attribute-value pairing mechanism where each atom, bond, or substructure can carry additional metadata fields.

The out-of-bounds write occurs when Open Babel processes malformed attribute-value pairs within a MOL2 file. The parsing logic fails to adequately validate the length of data being written when handling attribute values. When a crafted MOL2 file contains attribute fields with excessive or unexpected lengths, the parsing code writes data past the bounds of an allocated buffer. This memory corruption primitive provides an attacker with the ability to overwrite adjacent memory regions.

The affected code paths are reachable through standard Open Babel file-handling APIs that accept MOL2 input, such as the command-line tool obabel when converting or processing files, and library APIs used by downstream applications that embed Open Babel for molecular data processing.

The vulnerability is triggered purely by file processing — no special environment conditions or elevated privileges are required beyond the ability to cause Open Babel to parse a MOL2 file. The out-of-bounds write is a classic memory corruption vulnerability class (CWE-787) that can be leveraged for arbitrary code execution through techniques such as heap spraying, return-oriented programming (ROP), or overwriting function pointers, provided the attacker can control the corrupted data sufficiently.

The CVSS score of 8.1 reflects high confidentiality, integrity, and availability impacts, tempered by the requirement for user interaction (the victim must process a malicious file) and the high attack complexity involved in reliably achieving code execution from an out-of-bounds write primitive.

Exploitation Scenarios

The exploitation chain for CVE-2022-43607 follows a client-side attack model where the victim is induced to process a malicious MOL2 file:

1. Reconnaissance/Target Identification: An attacker identifies systems that use Open Babel to process molecular data. Targets include cheminformatics web services (such as online molecule converters, structure viewers, or property predictors), academic research pipelines that batch-process molecular files, and desktop applications built on Open Babel libraries. The attacker may probe these services to confirm that MOL2 files are accepted as input.

2. Flaw Trigger Mechanism: The attacker crafts a MOL2 file containing malformed attribute-value pairs specifically designed to trigger the out-of-bounds write in the parser. The malicious file must be syntactically valid enough to pass initial format checks but contain attribute fields with length values that exceed allocated buffer sizes. The file is delivered via standard social engineering vectors — email attachment, malicious download link, or direct upload to a vulnerable web service.

3. Payload Execution: Upon processing the malformed file, the out-of-bounds write corrupts adjacent heap memory. The attacker structures the corruption to overwrite critical data structures — potentially function pointers, heap metadata, or other memory regions — to redirect control flow. Given the 8.1 CVSS score and high attack complexity, reliable exploitation likely requires additional heap grooming and potentially multiple attempts to achieve stable code execution. The final payload executes in the context of the Open Babel process.

4. Post-Exploitation Impact: Successful code execution grants the attacker the same privileges as the user running the Open Babel process. In desktop scenarios, this typically means the end-user's account with access to local files, credentials, and potentially elevated network access. In server-side deployments (web services), the attacker gains code execution within the web application's service account, which could enable further lateral movement, data exfiltration, or persistent backdoor installation.

No public PoC is available for this vulnerability as of the EPSS assessment date (EPSS score 0.00782, 52.6% percentile). The attack chain described is inferred from the vulnerability class (out-of-bounds write during file parsing) and standard exploitation methodologies.

Impact Assessment

Business Impact: The primary affected populations are (1) academic and industrial research organizations that use Open Babel for computational chemistry, drug discovery, and molecular modeling; (2) software vendors that embed Open Babel in cheminformatics tools, virtual screening platforms, and chemical database management systems; and (3) any organization operating Web-based molecular file processing services.

Blast Radius: The vulnerability is remotely exploitable only if the affected system exposes file-processing capabilities to untrusted input. Fully offline desktop usage presents limited risk unless combined with social engineering. Internet-facing cheminformatics services that accept file uploads represent the highest-risk deployment scenario. Given that Open Babel uses a permissive GPL-2.0 license and is widely embedded in commercial and open-source tools, the actual number of downstream affected applications is likely substantial.

CVSS Analysis: The 8.1 score (High) balances the serious impact (high C/I/A) against mitigating factors — requiring user interaction (UI:R) and high attack complexity (AC:H). The network attack vector (AV:N) reflects that malicious files can be delivered remotely, while the scope is unchanged (S:U), meaning compromise is limited to the target process and host.

Confidence Assessment: The EPSS score of 0.00782 (52.6th percentile) indicates a moderately low but non-zero probability of exploitation in the wild. The absence of CISA KEV listing, no known PoC, and no confirmed exploitation activity suggest the vulnerability has not yet been widely weaponized. However, the unpatched status combined with the criticality of arbitrary code execution raises the risk profile significantly.

Detection Guidance

Sigma Rule

title: Open Babel MOL2 Parsing Out-of-Bounds Write Exploitation
id: 7a3c9f2e-4b81-4a6d-9e3c-2d5f8a1b7c4e
status: experimental
description: Detects processes associated with Open Babel crashing or exhibiting abnormal behavior when processing MOL2 files, which may indicate exploitation of CVE-2022-43607
author: Valtersit Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\obabel.exe'
            - '\babel.exe'
        CommandLine|contains:
            - '.mol2'
            - '-imol2'
            - '--input'
    crash_selection:
        EventID: 1000  # Application crash (Windows Error Reporting)
    condition: selection and crash_selection
falsepositives:
    - Legitimate crashes of the tool when processing malformed but benign files
    - High volume of molecular file processing in research environments
level: high
tags:
    - attack.t1203
    - cve.2022-43607

YARA Rule

rule CVE_2022_43607_OpenBabel_MOL2
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects MOL2 files with anomalous attribute-value fields that may trigger the out-of-bounds write in Open Babel"
        cve = "CVE-2022-43607"
        date = "2024-01-01"
    strings:
        $mol2_header = "@<TRIPOS>MOLECULE" nocase
        $atom_section = "@<TRIPOS>ATOM" nocase
        $substruct_section = "@<TRIPOS>SUBSTRUCTURE" nocase
        $attr_keyword = "USER_CHARGES" nocase
        $status_keyword = "STATUS" nocase
        $excess_length = /(SUBST_NAME\s+.{100,})/ nocase
        $excess_attr = /(ATTRIBUTE\s+.{200,})/ nocase
    condition:
        $mol2_header and ($atom_section or $substruct_section) and 
        (1 of ($excess_*))
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2022-43607 Open Babel MOL2 Parsing OOB Write Attempt"; flow:established,to_server; content:"@<TRIPOS>MOLECULE"; nocase; content:"@<TRIPOS>ATOM"; distance:0; nocase; pcre:"/@<TRIPOS>SUBSTRUCTURE[\r\n]{1,2}(?:[^\r\n]*[\r\n]{1,2}){0,10}.*(?:SUBST_NAME|ATTRIBUTE)\s+.{200,}/i"; sid:10000001; rev:1; reference:cve,2022-43607; classtype:attempted-user-admin; metadata:created_at 2024-01-01, updated_at 2024-01-01, cve 2022-43607;)

Elastic Detection

// EQL query for Elastic SIEM
any where
  // File creation events for MOL2 files with anomalous characteristics
  (event.category == "file" and file.name like "*.mol2") or
  // Process events flagging Open Babel execution with MOL2 input
  (event.category == "process" and process.name in ("obabel.exe", "babel.exe") and 
   process.args like "*.mol2") or
  // Crash events indicating memory corruption
  (event.category == "process" and event.type == "end" and 
   process.exit_code == -1073740940) // 0xC0000374 STATUS_HEAP_CORRUPTION

Splunk SPL Query

// Detect Open Babel process crashes or abnormal exits following MOL2 file processing
(index=windows OR index=endpoint) 
  (source="WinEventLog:Application" EventCode=1000 
    Message="*obabel.exe*") 
  OR 
  (sourcetype=XmlWinEventLog 
    EventCode=1000 
    Message="*faulting module*" 
    Message="*obabel*")
| stats count by host, Message
| where count > 3
| sort - _time

// Alternative: Detect web service uploads of suspicious MOL2 files
index=web sourcetype=iis OR sourcetype=apache
  uri_path="*upload*" 
  form_data="*.mol2*"
| eval mol2_anomaly = if(match(form_data, ".{200,}"), "suspicious", "normal")
| where mol2_anomaly=="suspicious"
| table _time, src_ip, uri_path, form_data, host

Wazuh OSSEC Rule

<group name="openbabel, cve-2022-43607,">
  <rule id="100201" level="14">
    <if_sid>500</if_sid>
    <program_name>obabel|babel</program_name>
    <description>Open Babel process crash possibly related to CVE-2022-43607 MOL2 parsing OOB write</description>
    <group>attack.t1203,</group>
  </rule>

  <rule id="100202" level="10">
    <if_sid>100201</if_sid>
    <match>segmentation fault|core dumped|abort|heap corruption|SIGSEGV</match>
    <description>Open Babel crashed with memory corruption signal after processing MOL2 file - likely CVE-2022-43607 exploitation attempt</description>
    <group>attack.t1203,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor has not confirmed a fix, and no patched version of Open Babel has been identified. Organizations MUST assume that all versions up to and including 3.1.1 and master commit 530dbfa3 remain vulnerable.

1. Immediate Mitigations:

• Isolate file processing: Run Open Babel in a sandboxed environment (Docker container without network access, dedicated virtual machine, or application-level sandbox) to contain any exploitation attempts.
• File sanitization: Implement file pre-filtering to reject MOL2 files with anomalous attribute-value structures before they reach Open Babel. Basic sanity checks on file structure and attribute lengths can block simple exploit payloads.
• Least privilege: Ensure that services using Open Babel run under low-privilege service accounts with no administrative or broader network access. Disable interactive logon for these accounts.
• Input validation: Where feasible, use alternative molecular file parsers or validation libraries to pre-verify MOL2 file structure before processing with Open Babel.
• Monitoring: Deploy the detection rules provided above to identify crash events or anomalous file uploads that may indicate exploitation attempts.

2. Patch/Upgrade Steps:

• Monitor the Open Babel GitHub repository (github.com/openbabel/openbabel) and official releases page for a security advisory and patched version.
• Subscribe to NVD notifications and, if applicable, the vendor's security mailing list for updates regarding CVE-2022-43607.
• When a patched version becomes available, test compatibility with existing pipelines, then deploy in a staged rollout. Review the patch diff if source is available to confirm the fix addresses the MOL2 attribute-value length validation.

3. Long-Term Hardening:

• Network posture: Do not expose Open Babel processing capabilities directly to the internet. Place file-processing services behind secure API gateways with authentication, rate limiting, and file type/content filtering.
• File type restrictions: Restrict accepted MOL2 file sizes and reject files with unusually large attribute sections during upload validation.
• Supply chain review: Audit all applications and libraries that embed Open Babel to understand the full exposure scope. Consider temporary platform-level restrictions on these applications while unpatched.
• Compensating controls: Deploy runtime application self-protection (RASP) or memory integrity controls on hosts that process untrusted molecular data. Enable ASLR, DEP, and Control Flow Guard where available on Windows; and ASLR, NX, and heap hardening on Linux.
• Incident readiness: Add exploitation of CVE-2022-43607 to threat models and tabletop exercises — the unpatched state means risk persists indefinitely.

References

1. NVD Entry — CVE-2022-43607: https://nvd.nist.gov/vuln/detail/CVE-2022-43607
2. Open Babel Official Repository — https://github.com/openbabel/openbabel
3. Open Babel Official Website — http://openbabel.org/wiki/Main_Page
4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2022-43607 not currently listed)
5. MITRE ATT&CK Technique T1203 — Exploitation for Client-Side Execution: https://attack.mitre.org/techniques/T1203/

Exploitation Activity: As of the assessment date, CVE-2022-43607 has no confirmed exploitation in the wild. It is not listed in CISA KEV, has no public PoC, and EPSS assesses a low-to-moderate exploitation likelihood (0.00782). No threat actor campaigns have been publicly attributed to this vulnerability. However, the unpatched status and the criticality of arbitrary code execution make this a valuable target for future weaponization; continuous monitoring is strongly advised.