CVE-2022-1292 PoC — The c_rehash script allows command injection

Source

https://github.com/und3sc0n0c1d0/CVE-2022-1292

Associated Vulnerability

Title: The c_rehash script allows command injection (CVE-2022-1292)
Description:The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

Description

Automation to validate the impact of the vulnerability CVE-2022-1292 on a specific system.

Readme

# CVE-2022-1292
Automation to validate the impact of the vulnerability CVE-2022-1292 on a specific system.

This script checks, validates and exploits the vulnerability.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →