Threat Intelligence Report — CVE-2022-4778

Executive Summary

CVE-2022-4778 is a path traversal vulnerability affecting NCSC.ch StreamX applications versions 6.02.01 through 6.04.34. The flaw exists in the StreamView HTML component when the public web server feature is enabled, allowing authenticated users to read arbitrary files from the server's filesystem — including configuration files, credentials, and other sensitive data. NCSC.ch has released version 6.04.35 which addresses the vulnerability. No public exploit code or CISA KEV listing exists for this CVE; however, the EPSS score of 0.00657 (48.3rd percentile) suggests moderate likelihood of future exploitation in the wild.

Technical Analysis

Vulnerability Class: Path Traversal (CWE-22)

Affected Component: StreamView HTML component (distributed with StreamX applications)

Root Cause: Based on the NVD description, the StreamView HTML component fails to properly validate or sanitize user-supplied file path parameters when serving static content through the public web server feature. When an authenticated user submits crafted file path traversal sequences (e.g., using ../ — though this exact payload is not confirmed, it is the standard mechanism for this vulnerability class), the application passes the request through to the underlying filesystem API without adequate path normalization or containment checks.

Affected Configuration:

• StreamX versions 6.02.01 through 6.04.34
• StreamView HTML component in use
• Public web server feature activated (this is a prerequisite for exploitation)

Why the"public web server feature" matters: The vulnerability is only reachable when the public web server feature is enabled. This suggests that the path traversal exists in the HTTP request handler that maps URL paths to filesystem paths for static file serving. When this feature is disabled, the vulnerable code path is not reachable.

Attack Surface:

• Network-reachable from the public internet or internal networks (depending on server placement)
• Requires an authenticated session (low-privilege account sufficient)
• No user interaction required from the victim
• The web server must be configured with the StreamView HTML component

Technical Detail Available: The official description does not specify the exact URL structure, parameter names, or traversal encoding method. Insufficient technical detail is available to determine whether the flaw resides in:

• URL path handling (e.g., /static/../../etc/passwd)
• A file-serving API endpoint (e.g., a file= or path= parameter)
• A web component that proxies or exposes file operations

Without vendor source code or additional advisory details, the precise mechanism remains inferred from the vulnerability class.

Chain of events for exploitation:

1. Attacker authenticates to the StreamX application (credentials may be obtained via phishing, default credential use, brute force, or prior compromise)
2. Attacker crafts an HTTP request to the StreamView HTML component
3. The request contains path traversal sequences in a filename/path parameter
4. The server fails to neutralize the traversal sequences, returning the contents of an arbitrary file

What the CVSS suggests:

• Score: 6.5 (Medium)
• Access Vector: Network — remotely exploitable
• Attack Complexity: Low — no special conditions needed
• Privileges Required: Low — a basic authenticated user account suffices
• User Interaction: None — no victim action needed
• Impact: High confidentiality, no integrity/availability impact

Exploitation Scenarios

Important Disclaimer: No public PoC or exploit code exists for CVE-2022-4778 as of this report. The following exploitation chain is inferred from the vulnerability class (path traversal) and the NVD description. Specific URL patterns and parameter names are not confirmed and should not be treated as fact.

Scenario 1: Configuration File Disclosure

Step 1 — Reconnaissance / Target Identification: The attacker identifies StreamX instances exposed on the internet. Shodan dorks such as http.title:"StreamX" or http.html:"StreamView" may reveal candidates. Alternatively, the attacker may already be inside the network via VPN or other access.

Step 2 — Authentication: The attacker authenticates with any valid user account. Since the vulnerability requires only low privileges, even a read-only operator account suffices. Credentials may be:

• Default credentials (if not changed): common for industrial SCADA-style platforms
• Obtained from prior breaches
• Brute-forced (if no account lockout policy exists)

Step 3 — Crafting the Path Traversal Request: The attacker forms an HTTP request to the StreamView HTML component. The request includes a file path parameter containing traversal sequences (e.g., ../../../../etc/shadow or with URL-encoded variants like ..%2f..%2f). The exact parameter name is unknown from public data.

Step 4 — Post-Exploitation Impact: The server returns the contents of the requested file. Examples of valuable targets:

• /etc/passwd and /etc/shadow — for password cracking
• Application configuration files containing database credentials
• Private keys (SSH, TLS)
• Source code or other intellectual property
• Log files containing session tokens or other sensitive data

Scenario 2: Internal File Harvesting

Step 1 — Reconnaissance: Same as above.

Step 2 — Authentication: Same as above.

Step 3 — Systematic Disclosure: The attacker enumerates filesystem paths iteratively, harvesting:

• Database connection strings
• API tokens
• Service account credentials
• Other StreamX user account hashes

Step 4 — Post-Exploitation: The harvested credentials are used to pivot laterally into databases, other application servers, or the underlying operating system. Path traversal becomes the first step in a larger network compromise chain.

Scope and Constraints:

• Authenticated-only: This is not an unauthenticated vulnerability. The attacker must possess valid credentials, which raises the practical complexity.
• Read-only: Only file disclosure is possible. The vulnerability does not permit writing files, executing code, or escalating privileges directly through this flaw.
• No user interaction: Suitable for automated exploitation once credentials are obtained.

Impact Assessment

Business Impact: High Confidentiality Breach Potential

The path traversal flaw provides authenticated users with the ability to read arbitrary files on the host filesystem. The realized impact depends on what data resides on the server:

Affected Systems:

• All StreamX installations on versions 6.02.01 through 6.04.34
• Only those with StreamView HTML component deployed
• Only those with the public web server feature enabled

Blast Radius:

• Direct: One server's filesystem contents per affected StreamX instance
• Indirect: If the server stores shared credentials or access tokens, the blast radius extends to connected systems, databases, and network infrastructure
• Regulatory: If the disclosed files contain PII (GDPR/CCPA), PHI (HIPAA), or PCI data, notification obligations may arise

CVSS Subscore Analysis (reconstructed vector):

• Confidentiality Impact: High — arbitrary file read capability
• Integrity Impact: None — no write capability via this flaw
• Availability Impact: None — cannot disrupt service through this CVE
• Privileges Required: Low — any authenticated user suffices
• Attack Complexity: Low — no special conditions or race conditions

Realistic Assessment: In practice, the severity is often higher than the 6.5 CVSS score suggests when the server hosts configuration files with production secrets. Alternatively, if the application runs with minimal privileges and separates content from critical system files, the realized impact diminishes.

Detection Guidance

Detection Note: Since no public exploitation evidence or specific payload signatures exist for CVE-2022-4778, the following detection rules focus on path traversal exploit patterns that would apply to this vulnerability class. Rules should be tuned to the organization's specific StreamX deployment and validated against normal traffic baselines.

Sigma Rule

title: Path Traversal Attempt Against StreamX StreamView Component
id: 4a9c62e1-1c79-4a29-9e29-2ee2a1eac531
status: experimental
description: Detects path traversal sequences in HTTP requests targeting StreamX StreamView HTML component endpoints
author: Valters IT Security Team
date: 2024/01/15
tags:
    - attack.t1190
    - attack.initial-access
    - cve.2022-4778
logsource:
    category: webserver
    definition: 'Web server access logs from IIS, Apache, or Nginx serving StreamX apps'
detection:
    selection_path_traversal:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri-query|contains:
            - '..%2f'
            - '..%5c'
            - '..;/'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
            - '..%00'
            - '....//'
            - '/../'
            - '\\..\\'
    selection_streamx:
        cs-uri-stem|contains:
            - '/view/'
            - '/streamview/'
            - '/file/'
            - '/download/'
    condition: selection_path_traversal and selection_streamx
    falsepositives:
        - 'Legitimate path traversal handling in custom StreamX applications'
        - 'URL encoding used for non-malicious purposes'
    level: high
    fields:
        - src_ip
        - cs-uri-query
        - cs-username
        - cs-host

YARA Rule

rule CVE_2022_4778_StreamX_PathTraversal
{
    meta:
        author = "Valters IT Security"
        description = "Detects path traversal patterns in web requests targeting StreamX StreamView"
        date = "2024-01-15"
        cve = "CVE-2022-4778"
        severity = "high"
        tlp = "amber"

    strings:
        $traversal_decimal = /\.\.%2f|%2e%2e%2f/
        $traversal_backslash = /\.\.%5c|\.\.\\/
        $traversal_raw = /\.\.\//
        $traversal_unicode = /\u002e\u002e\u002f/
        $streamx_marker = /streamview|streamx/i

        // File targets of interest
        $etc_passwd = /etc\/passwd/
        $etc_shadow = /etc\/shadow/
        $windows_sys = /windows\/win\.ini/i
        $env_file = /\.env|\.config|\.ini/i

    condition:
        any of them and
        ($streamx_marker) and
        (
            $traversal_decimal or
            $traversal_backslash or
            $traversal_raw or
            $traversal_unicode
        )
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT CVE-2022-4778 Path Traversal Attempt Against StreamX StreamView";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:/\/streamview\/|\/view\/|\/file\//;
    http_uri;
    content:"../";
    http_uri;
    content:!".";
    http_uri;
    classtype:attempted-user;
    sid:20224778;
    rev:1;
    metadata:created_at 2024_01_15, updated_at 2024_01_15, cve CVE-2022-4778;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2022-4778;
    reference:cve,2022-4778;
    threshold:type limit, track by_src, count 10, seconds 60;
)

Elastic Detection

// EQL query for Elastic Security

sequence by source.ip with maxspan=5m
  [ network where
      dns.question.name : "*streamx*" or
      destination.port in (80, 443, 8080) and
      url.path : (
        "*/streamview/*",
        "*/view/*",
        "*/file/*",
        "*/download/*"
      )
  ]
  [ http where
      http.request.uri : (
        "*../*",
        "*..%2f*",
        "*%2e%2e*",
        "*..%5c*",
        "*..\\*"
      ) and
      http.request.uri : (
        "*/streamview*",
        "*/view*",
        "*/file*",
        "*/download*"
      ) and
      // Exclude baseline web crawling
      not user_agent.name : ("Googlebot", "Bingbot") 
  ]

Splunk SPL Query

index=web* sourcetype=iis OR sourcetype=apache OR sourcetype=nginx
| where uri_path LIKE "%/streamview/%" OR uri_path LIKE "%/view/%" OR uri_path LIKE "%/file/%"
  OR uri_path LIKE "%/download/%"
| where uri LIKE "%../%" OR uri LIKE "%..%2f%" OR uri LIKE "%..%2F%" 
  OR uri LIKE "%2e%2e%2f%" OR uri LIKE "%2E%2E%2F%" OR uri LIKE "%..%5c%" 
  OR uri LIKE "%..%5C%" OR uri LIKE "%..\\%"
| eval attack_type = "CVE-2022-4778 Path Traversal Attempt",
         confidence = case(
             match(uri, "(?i)(etc/passwd|etc/shadow|win.ini|boot.ini|\.env)"), "HIGH - System file target",
             match(uri, "(?i)(\.config|\.ini|\.xml|\.json|\.yml|\.yaml)"), "MEDIUM - Config file target",
             true(), "LOW - Generic traversal attempt"
         )
| stats count by src_ip, dest_ip, uri, http_method, confidence, status
| sort - count, confidence
| table _time, src_ip, dest_ip, uri, http_method, status, confidence, count

Wazuh OSSEC Rule

<group name="streamx,">
    <rule id="330510" level="10">
        <decoded_as>json</decoded_as>
        <field name="url">\.\./|\.\.%2f|\.\.%2F|%2e%2e%2f|%2E%2E%2F|\.\.%5c|\.\.%5C</field>
        <field name="url">streamview|view|file|download</field>
        <description>CVE-2022-4778: Path traversal attempt against StreamX StreamView component</description>
        <group>attack,exploitation,web_application_attack,cve_2022_4778</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <options>no_full_log</options>
        <alert>
            <regex>srcip</regex>
            <regex>url</regex>
        </alert>
    </rule>
    
    <rule id="330511" level="13">
        <if_sid>2024778</if_sid>
        <field name="url">etc/passwd|etc/shadow|win\.ini|boot\.ini</field>
        <description>CVE-2022-4778: Path traversal targeting sensitive system files against StreamX</description>
        <group>attack,exploitation,web_application_attack,cve_2022_4778,critical</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch; not independently confirmed)

1. Immediate Mitigations (Hours to Days)

1. Upgrade StreamX: Per the vendor advisory, upgrade to version 6.04.35 or above as soon as possible. This is the only officially confirmed remediation.
2. Disable the public web server feature: If the StreamView HTML component's public web server feature is not essential to operations, disable it immediately. This is the documented prerequisite for exploitation — disabling it eliminates the attack surface.
3. Restrict network access: If the feature cannot be disabled immediately, restrict access to the StreamX web interface:
   • Allow only authenticated internal network IP ranges
   • Place behind a VPN or bastion host
   • Use network ACLs to block external access
4. Enforce strong authentication: Since exploitation requires an authenticated account:
   • Enforce multi-factor authentication (MFA), if supported
   • Audit all user accounts for stale or unused credentials
   • Change any default credentials
5. Monitor: Deploy the detection rules from this report to identify and alert on path traversal attempts.

2. Patch / Upgrade Steps

1. Verify current version: Identify your StreamX deployment version.
2. Obtain the fix: Contact NCSC.ch or your vendor/support channel for the 6.04.35 (or later) upgrade package.
3. Test in staging:
   • Validate the upgrade on a non-production instance
   • Confirm the public web server feature still functions as expected
   • Run regression tests on StreamView HTML component behavior
4. Deploy to production:
   • Schedule a maintenance window
   • Back up the current configuration and application data
   • Apply the upgrade
   • Verify version in control panel/deployment manifest
5. Validate the fix:
   • Attempt path traversal requests to confirm the vulnerability is closed
   • Confirm normal functionality
6. Continue monitoring: Some sources claim the patch; validate in your environment.

3. Long-Term Hardening

1. Disable unnecessary features: Audit whether the public web server feature is truly needed for all StreamView HTML deployments. Disable where not required.
2. Apply the principle of least privilege:
   • Run StreamX under a low-privilege OS account
   • Restrict filesystem access to application-specific directories only
   • Ensure the application cannot read arbitrary system files
3. Segment the network: Place StreamX and similar SCADA/ICS-facing applications in isolated network segments with strict east-west traffic monitoring.
4. Credential hygiene:
   • Implement standing authentication reviews
   • Enforce least-privilege user roles (read-only accounts where possible)
   • Require MFA for all interactive access
5. Web application firewall (WAF): Deploy a WAF in front of StreamX with rules blocking traversal sequences (../, URL-encoded variants, etc.).
6. Regular patching cadence: Subscribe to NCSC.ch advisory channels and apply vendor patches within 30 days of release, prioritizing security fixes.
7. Incident readiness: Maintain an incident response plan that covers supply-chain and ICS/SCADA-specific scenarios.
8. Monitoring baseline: Keep detection rules updated and review baseline traffic to minimize false positives.

References

1. NVD Entry (Authoritative): https://nvd.nist.gov/vuln/detail/CVE-2022-4778 Official NVD record with the CNA-provided description and CVSS score (6.5).

2. Vendor / CNA Advisory: NCSC.ch (Swiss National Cyber Security Centre) is the assigning CNA. The patch was announced via this channel; contact your NCSC.ch sales/support representative for the official advisory bulletin for version 6.04.35.

3. MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4778 CVE record with CNA title confirming path traversal in StreamX StreamView HTML component.

4. EPSS (Exploit Prediction Scoring System): Score: 0.00657 (48.3rd percentile) Reference: https://www.first.org/epss/

5. CISA Known Exploited Vulnerabilities Catalog: CVE-2022-4778 is NOT listed in the KEV catalog. Verify periodically: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns & Exploit-in-the-Wild Evidence: None identified at the time of writing. No public exploit code, PoC repository, or threat actor campaign references CVE-2022-4778 as of this report. The vulnerability remains in a "potential exploitation" state with moderate predicted likelihood per EPSS percentile. Analysts should re-check threat intelligence feeds periodically, as discovery of weaponized exploits would change the risk posture significantly.

Report generated by Valters IT Security Team — February 2025. Analysis based on publicly available CVE data. All detection rules should be tested and tuned in the target environment before production deployment.