Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-31022— Missing Role Based Access Control for the REST handlers in bleve/http package

Quick assessment

Affected
blevesearch bleve
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

bleve是用于 Go 的现代文本索引库。 bleve v0.1.0 之后版本存在安全漏洞，该漏洞源于 bleve/http 包主要用于演示目的，它缺乏对用户输入的详尽验证以及任何身份验证和授权措施。

CVSS 6.2 · Medium EPSS 0.34% · P26

Possible ATT&CK Techniques 1 AI

T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-31022

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Missing Role Based Access Control for the REST handlers in bleve/http package
Source: CVE Program / CVE List V5
Vulnerability Description
Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a node’s filesystem where the bleve index resides, if the user has used bleve’s own HTTP (bleve/http) handlers for exposing the access to the indexes. For instance, the CreateIndexHandler (`http/index_create.go`) and DeleteIndexHandler (`http/index_delete.go`) enable an attacker to create a bleve index (directory structure) anywhere where the user running the server has the write permissions and to delete recursively any directory owned by the same user account. Users who have used the bleve/http package for exposing access to bleve index without the explicit handling for the Role Based Access Controls(RBAC) of the index assets would be impacted by this issue. Version 2.5.0 relocated the `http/` dir used _only_ by bleve-explorer to `blevesearch/bleve-explorer`, thereby addressing the issue. However, the http package is purely intended to be used for demonstration purposes. Bleve was never designed handle the RBACs, nor it was ever advertised to be used in that way. The collaborators of this project have decided to stay away from adding any authentication or authorization to bleve project at the moment. The bleve/http package is mainly for demonstration purposes and it lacks exhaustive validation of the user inputs as well as any authentication and authorization measures. It is recommended to not use bleve/http in production use cases.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用候选路径或通道进行的认证绕过
Source: CVE Program / CVE List V5
Vulnerability Title
bleve 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
bleve是用于 Go 的现代文本索引库。 bleve v0.1.0 之后版本存在安全漏洞，该漏洞源于 bleve/http 包主要用于演示目的，它缺乏对用户输入的详尽验证以及任何身份验证和授权措施。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
blevesearch bleve >= 0.1.0, < 2.5.0 -

II. Public POCs for CVE-2022-31022

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-31022

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-31022 (1)

Vendor Advisories for CVE-2022-31022 (1)

IV. Related Vulnerabilities

Same weakness: CWE-288

V. Comments for CVE-2022-31022

No comments yet

Leave a comment