CVE-2022-28462
📋 TL;DR
CVE-2022-28462 is an arbitrary file reading vulnerability in novel-plus 3.6.0 that allows attackers to read sensitive files from the server filesystem. This affects all deployments of novel-plus 3.6.0, potentially exposing configuration files, credentials, and other sensitive data.
💻 Affected Systems
- novel-plus
📦 What is this software?
Novel Plus by Xxyopen
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files like /etc/passwd, configuration files containing database credentials, SSH keys, or other secrets leading to complete system compromise.
Likely Case
Attackers will read application configuration files to extract database credentials, API keys, and other sensitive information that can be used for further attacks.
If Mitigated
With proper file permissions and network segmentation, impact is limited to files accessible by the web server process, but sensitive data may still be exposed.
🎯 Exploit Status
The vulnerability is simple to exploit with publicly available proof-of-concept code. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.6.0
Vendor Advisory: https://github.com/201206030/novel-plus/issues/85
Restart Required: Yes
Instructions:
1. Upgrade novel-plus to version 3.6.1 or later. 2. Restart the novel-plus application. 3. Verify the fix by testing the file reading vulnerability.
🔧 Temporary Workarounds
File Permission Restriction
linuxRestrict web server process permissions to limit accessible files
chmod 600 sensitive_config_files
chown root:root sensitive_files
Web Application Firewall Rule
allBlock requests containing path traversal patterns
🧯 If You Can't Patch
- Implement strict network access controls to limit novel-plus exposure
- Deploy web application firewall with path traversal detection rules
🔍 How to Verify
Check if Vulnerable:
Test if you can access files outside the web root using path traversal (e.g., ../../etc/passwd)Check Version:
Check novel-plus version in application interface or configuration filesVerify Fix Applied:
After patching, attempt the same file reading attack to confirm it's blocked📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing ../ patterns
- Unusual file access patterns from web logs
- Failed file access attempts outside web root
Network Indicators:
- HTTP requests with multiple ../ sequences
- Requests for known sensitive file paths
SIEM Query:
web_access_logs WHERE url CONTAINS '../' AND response_code = 200