Audit-log IP falsification via X-Forwarded-For
Published Nov 11, 2022 · Updated Aug 3, 2024
Log injection in Pojo Activity Log allows remote attackers to falsify recorded source IP addresses through crafted HTTP requests. The HTTP header handler accepts an attacker-controlled X-Forwarded-For value as the client address and writes it into the audit log without preserving its untrusted origin. No authentication is required to send the header, and the bounded consequence is corruption of log attribution rather than data disclosure or service interruption.
Summary
What happened
Log injection in Pojo Activity Log allows remote attackers to falsify recorded source IP addresses through crafted HTTP requests. The HTTP header handler accepts an attacker-controlled X-Forwarded-For value as the client address and writes it into the audit log without preserving its untrusted origin. No authentication is required to send the header, and the bounded consequence is corruption of log attribution rather than data disclosure or service interruption.
The record
- CVE
- CVE-2022-3941
- Published
- Nov 11, 2022
- Updated
- Aug 3, 2024
- Vendor
- Pojo
- Product
- Activity Log
- Classifications
- CWE-707, CWE-116, T1565.001
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Nov 11, 2022CVE publishedPublication date reported by the CVE source.
- Aug 3, 2024Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=n/a
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- X-Forwarded-For log-injection demonstration 2proof of concept · unverified
- X-Forwarded-For log-injection demonstration 1proof of concept · unverified
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo