CVE-2022-0281
📋 TL;DR
CVE-2022-0281 is an information disclosure vulnerability in Microweber CMS that exposes sensitive information to unauthorized actors. This affects all Microweber installations prior to version 1.2.11, potentially leaking configuration data, credentials, or other sensitive system information.
💻 Affected Systems
- Microweber CMS
📦 What is this software?
Microweber by Microweber
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to sensitive configuration files, database credentials, API keys, or other secrets that could lead to complete system compromise.
Likely Case
Unauthorized access to configuration files containing sensitive application settings and potentially database connection strings.
If Mitigated
Limited exposure of non-critical configuration data with proper access controls and network segmentation.
🎯 Exploit Status
The vulnerability involves accessing specific paths that expose sensitive files without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.11
Vendor Advisory: https://github.com/microweber/microweber/commit/e680e134a4215c979bfd2eaf58336be34c8fc6e6
Restart Required: No
Instructions:
1. Update Microweber to version 1.2.11 or later via Composer: composer update microweber/microweber
2. Alternatively, download and install the latest version from the official repository
3. Verify the update completed successfully
🔧 Temporary Workarounds
Restrict file access via web server configuration
allConfigure web server to block access to sensitive directories and files
For Apache: Add 'Deny from all' to .htaccess in sensitive directories
For Nginx: Add 'location ~ /(config|vendor|storage) { deny all; }' to server block
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to trusted networks only
- Deploy web application firewall (WAF) rules to block access to sensitive file paths
🔍 How to Verify
Check if Vulnerable:
Check if accessing /vendor/composer/installed.json or similar paths returns sensitive information without authenticationCheck Version:
composer show microweber/microweber | grep versionVerify Fix Applied:
Verify the version is 1.2.11 or later and test that sensitive paths no longer return information📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to requests for /vendor/composer/installed.json
- Access to sensitive file paths from unauthorized IPs
Network Indicators:
- Unusual GET requests to vendor or config directories
- Traffic patterns showing enumeration of sensitive paths
SIEM Query:
source="web_server" AND (uri_path="/vendor/composer/installed.json" OR uri_path CONTAINS "/vendor/") AND status=200🔗 References
- https://github.com/microweber/microweber/commit/e680e134a4215c979bfd2eaf58336be34c8fc6e6
- https://huntr.dev/bounties/315f5ac6-1b5e-4444-ad8f-802371da3505
- https://github.com/microweber/microweber/commit/e680e134a4215c979bfd2eaf58336be34c8fc6e6
- https://huntr.dev/bounties/315f5ac6-1b5e-4444-ad8f-802371da3505
