Is CVE-2022-23064 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-23064 being exploited in the wild.

How severe is CVE-2022-23064?

High severity, with a CVSS score of 8.8, published 3 May 2022.

Which products and versions are affected?

snipe/snipe-it (Packagist) >= 3.0-alpha, <= 5.3.7, ECOSYSTEM:introduced=3.0-alpha,fixed=5.3.8.

Is there a fix for CVE-2022-23064?

Yes. snipe/snipe-it (Packagist): upgrade to 5.3.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-23064 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2022-23064?

Check whether you run snipe/snipe-it (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-23064: Snipe-IT host header injection in password reset

Q: Is there a fix for CVE-2022-23064?

Yes. snipe/snipe-it (Packagist): upgrade to 5.3.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2022-23064 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2022-23064?

Check whether you run snipe/snipe-it (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-23064 · Severity: high · CVSS 8.8 · Published 2022-05-03

Snipe-IT is an open-source IT asset and license management system. A host header injection vulnerability in the password reset feature allows attackers to craft malicious password reset emails that direct users to attacker-controlled servers instead of the legitimate application. When users click these links, their password reset tokens are leaked to the attacker, enabling account takeover without needing the user's original password.

Technologies: snipe/snipe-it (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2022-23064 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-23064 being exploited in the wild.
How severe is CVE-2022-23064?: High severity, with a CVSS score of 8.8, published 3 May 2022.
Which products and versions are affected?: snipe/snipe-it (Packagist) >= 3.0-alpha, <= 5.3.7, ECOSYSTEM:introduced=3.0-alpha,fixed=5.3.8.
Is there a fix for CVE-2022-23064?: Yes. snipe/snipe-it (Packagist): upgrade to 5.3.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-23064 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2022-23064?: Check whether you run snipe/snipe-it (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snipe/snipe-it (Packagist): upgrade to 5.3.8 or later
```
composer require snipe/snipe-it:^5.3.8
```

Technical details

The vulnerability is a host header injection (CWE-74) in Snipe-IT's password reset functionality. When generating password reset links, the application insufficiently validates the HTTP Host header provided in the request, allowing an attacker to inject an arbitrary host value. An attacker with network access can send a specially crafted password reset request with a malicious Host header; the application then embeds this attacker-controlled host in the reset link sent to the user's email. When the user clicks the link, they are redirected to the attacker's server, exposing the reset token in the URL. The vulnerability requires user interaction (clicking the reset link) but no prior authentication or special privileges. Patch version 5.3.8 addresses this issue; all versions from 3.0-alpha through 5.3.7 are affected.

Affected products

Snipe Snipe-IT 3.0-alpha through 5.3.7

Identifiers

CVE-2022-23064
GHSA-9vh6-qfv6-vcqp

Timeline

2022-05-03: disclosed
2022: patched: Fixed in version 5.3.8

References

https://api.github.com/users/zyl71

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.