CVE-2022-41875
A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE (remote code execution) on the attacked system running Optica. The vulnerability was patched in v. 0.10.2, where the call to the function `oj.load` was changed to `oj.safe_load`.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.67% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- airbnb/optica
- Source
- security-advisories@github.com
References
- https://github.com/airbnb/optica/security/advisories/GHSA-cf87-4h6x-phh6Third Party Advisory
- https://github.com/ohler55/oj/blob/develop/pages/Security.mdThird Party Advisory
- https://www.rubydoc.info/gems/oj/3.0.2/Oj.safe_loadRelease Notes, Vendor Advisory
- https://github.com/airbnb/optica/security/advisories/GHSA-cf87-4h6x-phh6Third Party Advisory
- https://github.com/ohler55/oj/blob/develop/pages/Security.mdThird Party Advisory
- https://www.rubydoc.info/gems/oj/3.0.2/Oj.safe_loadRelease Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.