CVE-2022-0848: Part-db RCE Vulnerability via OS Injection

CVE-2022-0848 Overview

CVE-2022-0848 is a critical OS Command Injection vulnerability affecting Part-DB, an open-source electronic parts inventory management system. This vulnerability exists in versions prior to 0.5.11 and allows remote attackers to execute arbitrary operating system commands on the underlying server without requiring authentication.

The flaw stems from improper handling of file uploads, where the application fails to adequately validate or sanitize file extensions before processing. An attacker can exploit this weakness by uploading a malicious file with a crafted extension that bypasses security controls, ultimately leading to remote code execution on the target system.

Critical Impact

Unauthenticated attackers can achieve full remote code execution on affected Part-DB installations, potentially compromising the entire server infrastructure with complete confidentiality, integrity, and availability impact.

Affected Products

• Part-DB versions prior to 0.5.11
• part-db_project part-db (all versions before security patch)

Discovery Timeline

• 2022-03-04 - CVE CVE-2022-0848 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0848

Vulnerability Analysis

This OS Command Injection vulnerability (CWE-78) allows remote attackers to inject and execute arbitrary commands on the server through improper input validation in the file upload functionality. The vulnerability is network-accessible and requires no authentication or user interaction, making it highly exploitable in exposed deployments.

The attack targets the file upload mechanism in Part-DB where user-supplied file names are processed without proper sanitization. The application's failure to validate file extensions allows attackers to upload files that can be executed by the server, bypassing intended security restrictions.

Root Cause

The root cause of CVE-2022-0848 lies in the application's lack of file extension validation during the upload process. Prior to the security fix, Part-DB did not implement adequate checks to prevent the upload of potentially dangerous file types such as PHP scripts or other executable files.

The vulnerable code path allowed any file extension to be uploaded without restriction. When a malicious file (such as a web shell) is uploaded and subsequently accessed through the web server, it executes with the privileges of the web server process, enabling command injection and remote code execution.

Attack Vector

The attack vector for CVE-2022-0848 is network-based, requiring the attacker to have access to the Part-DB web interface. The exploitation flow typically involves:

1. An attacker identifies a Part-DB installation exposed to the network
2. The attacker crafts a malicious file (e.g., a PHP web shell) with an executable extension
3. The file is uploaded through the application's file upload functionality
4. The attacker accesses the uploaded file directly via the web server
5. The malicious code executes, granting command execution capabilities

The security patch addresses this by implementing a getExtensionFromFileName() function to properly extract and validate file extensions before processing uploads:

/**
 * Gets the file extension from a filename
 *
 * @param string    $filename The filename
 * @return string The extension of the file
 */
function getExtensionFromFileName($filename)
{
    $tmp = explode('.', $filename);
    return end($tmp);
}

Source: GitHub Part-DB Commit

Detection Methods for CVE-2022-0848

Indicators of Compromise

• Unexpected PHP or script files appearing in upload directories
• Web server logs showing requests to newly created files with executable extensions in upload paths
• Anomalous outbound network connections from the web server process
• Unusual process spawning from the PHP interpreter or web server daemon

Detection Strategies

• Monitor file system activity for creation of executable files (.php, .phtml, .phar) in web-accessible directories
• Implement web application firewall (WAF) rules to detect file upload attempts with dangerous extensions
• Review web server access logs for direct requests to files in upload directories
• Use endpoint detection to identify command execution chains originating from web server processes

Monitoring Recommendations

• Enable detailed logging for the Part-DB application and web server
• Configure alerts for file creation events in upload directories
• Implement integrity monitoring for the Part-DB installation directory
• Monitor for suspicious command execution patterns associated with the web server user account

How to Mitigate CVE-2022-0848

Immediate Actions Required

• Upgrade Part-DB to version 0.5.11 or later immediately
• Audit existing upload directories for any suspicious or unexpected files
• Review web server logs for signs of exploitation attempts
• If compromise is suspected, isolate the affected system and conduct forensic analysis
• Restrict network access to Part-DB installations to trusted networks only

Patch Information

The vulnerability has been addressed in Part-DB version 0.5.11. The fix introduces proper file extension validation in the inc/lib.php file, implementing the getExtensionFromFileName() function to safely extract and validate file extensions before allowing uploads.

Organizations should apply the patch by upgrading to Part-DB version 0.5.11 or later. The specific commit addressing this vulnerability is available at the GitHub Part-DB Commit. Additional details about the vulnerability disclosure can be found in the Huntr Bounty Report.

Workarounds

• Implement web server rules to block execution of uploaded files (e.g., disable PHP execution in upload directories)
• Configure file upload restrictions at the web server level to only allow safe file types
• Place the Part-DB installation behind a VPN or implement IP-based access controls
• Deploy a WAF with rules specifically designed to detect and block command injection attempts

# Apache configuration to disable PHP execution in uploads directory
<Directory "/var/www/part-db/data/media">
    php_admin_flag engine off
    <FilesMatch "\.php$">
        Deny from all
    </FilesMatch>
</Directory>