CVE-2022-28711
📋 TL;DR
CVE-2022-28711 is a memory corruption vulnerability in the cgi.c unescape functionality of ArduPilot APWeb, allowing an attacker to send a specially-crafted HTTP request to trigger memory corruption. This affects users of ArduPilot APWeb in the specified master branch versions, potentially leading to remote code execution or denial of service.
💻 Affected Systems
- ArduPilot APWeb
📦 What is this software?
Apweb by Ardupilot
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or device takeover.
Likely Case
Denial of service or application crash due to memory corruption.
If Mitigated
Limited impact if network access is restricted or patches are applied.
🎯 Exploit Status
Exploitation requires sending a crafted HTTP request, but no public proof-of-concept is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to a version after commit 46177cb9 or apply patches from vendor.
Vendor Advisory: https://github.com/ArduPilot/ardupilot/security/advisories
Restart Required: Yes
Instructions:
1. Check current ArduPilot version. 2. Update to the latest master branch or apply security patches. 3. Restart the APWeb service.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to APWeb to trusted IPs only.
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Disable APWeb if not required for operation.
- Implement network segmentation to isolate vulnerable systems.
🔍 How to Verify
Check if Vulnerable:
Check ArduPilot commit hash; if between 50b6b7ac and 46177cb9, it is vulnerable.Check Version:
git log --oneline -1Verify Fix Applied:
Verify the commit hash is after 46177cb9 and test with a crafted HTTP request.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to APWeb, memory error logs in system logs.
Network Indicators:
- HTTP requests with malformed or long parameters targeting APWeb.
SIEM Query:
source="apweb.log" AND (http_request CONTAINS "%" OR http_request LENGTH > 1000)