CVE-2022-2335 : What You Need to Know

Softing Secure Integration Server is affected by an integer underflow vulnerability, allowing a crafted HTTP packet with a -1 content-length header to trigger a denial-of-service condition in version V1.22.

Understanding CVE-2022-2335

This CVE involves an integer underflow vulnerability in Softing Secure Integration Server V1.22, which could lead to a denial-of-service condition when a malicious HTTP packet is sent with a specific content-length header.

What is CVE-2022-2335?

The CVE-2022-2335 vulnerability in Softing Secure Integration Server V1.22 arises from an integer underflow issue that can be exploited by an attacker to disrupt the service availability.

The Impact of CVE-2022-2335

The impact of CVE-2022-2335 is rated as high, with a CVSS base score of 7.5. An attacker can exploit this vulnerability over the network without requiring any privileges, resulting in a denial-of-service condition.

Technical Details of CVE-2022-2335

This section covers the vulnerability description, affected systems and versions, and exploitation mechanism.

Vulnerability Description

The vulnerability is due to an integer underflow in Softing Secure Integration Server V1.22, which can be triggered by sending a malicious HTTP packet with a -1 content-length header.

Affected Systems and Versions

Softing Secure Integration Server version V1.22 is specifically impacted by this vulnerability.

Exploitation Mechanism

By sending a specially crafted HTTP packet with a -1 content-length header, an attacker can exploit this vulnerability to initiate a denial-of-service attack.

Mitigation and Prevention

To address CVE-2022-2335, follow these mitigation strategies:

Immediate Steps to Take

Softing has released new versions, including V1.30, to fix the vulnerabilities. Users are advised to update to the latest version.

Long-Term Security Practices

Change the admin password or create a new user with administrative rights, deleting the default admin user.
Configure the Windows firewall to block network requests to IP port 9000.
Disable the HTTP Server in NGINX configuration, only allowing the HTTPS server.

Patching and Updates

Users should download the latest software packages from the Softing website to secure their systems. For detailed information and further mitigations, refer to the SYT-2022-4 notice on the Softing security website.