CVE-2022-32409
📋 TL;DR
This CVE describes a Local File Inclusion (LFI) vulnerability in Portal do Software Publico Brasileiro i3geo version 7.0.5 that allows attackers to execute arbitrary PHP code via crafted HTTP requests to codemirror.php. The vulnerability affects organizations using this specific version of i3geo software, potentially allowing complete system compromise.
💻 Affected Systems
- Portal do Software Publico Brasileiro i3geo
📦 What is this software?
I3geo by Softwarepublico
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise leading to data theft, ransomware deployment, or complete server takeover
Likely Case
Arbitrary code execution leading to web shell installation and lateral movement within the network
If Mitigated
Limited impact if proper input validation and file inclusion restrictions are implemented
🎯 Exploit Status
Proof of concept available on GitHub demonstrating exploitation
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to newer versions if available or implementing workarounds.
🔧 Temporary Workarounds
Restrict access to codemirror.php
allBlock or restrict HTTP access to the vulnerable codemirror.php file
# Apache: Add to .htaccess
<Files "codemirror.php">
Order Deny,Allow
Deny from all
</Files>
# Nginx: Add to server block
location ~ /codemirror\.php$ {
deny all;
return 403;
}
Implement input validation
allAdd strict input validation to prevent file path manipulation
# In codemirror.php, add input validation:
$allowed_files = ['file1.php', 'file2.php'];
if (!in_array($_GET['file'], $allowed_files)) {
die('Invalid file request');
}
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block LFI patterns
- Isolate the vulnerable system in a restricted network segment
🔍 How to Verify
Check if Vulnerable:
Check if codemirror.php exists and is accessible via HTTP, and test with known LFI payloadsCheck Version:
Check i3geo version in configuration files or admin interfaceVerify Fix Applied:
Test that codemirror.php no longer accepts arbitrary file paths or returns 403 when blocked📡 Detection & Monitoring
Log Indicators:
- HTTP requests to codemirror.php with unusual file parameters
- Multiple failed attempts to access restricted files
Network Indicators:
- Unusual outbound connections from web server
- HTTP requests containing path traversal patterns (../, ..\)
SIEM Query:
source="web_logs" AND uri="*codemirror.php*" AND (param="*../*" OR param="*..\*" OR param="*php://*" OR param="*data://*")🔗 References
- https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt
- https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
- https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt
- https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
