CVE-2022-43467
📋 TL;DR
This critical vulnerability in Open Babel allows arbitrary code execution through an out-of-bounds write when processing specially crafted PQS format files. Attackers can exploit this by providing malicious files to trigger the vulnerability. All systems running vulnerable versions of Open Babel that process untrusted PQS files are affected.
💻 Affected Systems
- Open Babel
📦 What is this software?
Open Babel by Openbabel
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the affected system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Remote code execution allowing attackers to execute arbitrary commands, install malware, or pivot to other systems in the network.
If Mitigated
Limited impact if proper input validation and file processing restrictions are in place, potentially reduced to denial of service.
🎯 Exploit Status
The vulnerability requires only a malicious file to trigger, making exploitation straightforward. Public proof-of-concept exists in the Talos Intelligence report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Open Babel 3.1.2 or later
Vendor Advisory: https://github.com/openbabel/openbabel/security/advisories/GHSA-4j4x-7p99-6jxf
Restart Required: No
Instructions:
1. Update Open Babel to version 3.1.2 or later. 2. For Linux systems: Use package manager (apt-get update && apt-get upgrade openbabel). 3. For source installations: Download latest version from GitHub and recompile. 4. Verify the update with 'obabel --version'.
🔧 Temporary Workarounds
Disable PQS file processing
allConfigure Open Babel to reject or skip PQS format files
obabel -L formats | grep -i pqs
# Review and modify configuration to exclude PQS format
Input validation and sandboxing
linuxImplement strict file validation and run Open Babel in restricted environment
# Use chroot, containers, or AppArmor/SELinux to restrict Open Babel
🧯 If You Can't Patch
- Implement strict file upload controls and only allow trusted PQS files
- Isolate Open Babel processes using containerization or virtualization
🔍 How to Verify
Check if Vulnerable:
Check Open Babel version with 'obabel --version' and compare to affected versions (3.1.1 or master commit 530dbfa3).Check Version:
obabel --versionVerify Fix Applied:
Verify version is 3.1.2 or later with 'obabel --version' and test with sample PQS files from the Talos report.📡 Detection & Monitoring
Log Indicators:
- Segmentation faults or crashes in Open Babel processes
- Unusual file processing of PQS format files
- Suspicious command execution following file processing
Network Indicators:
- Unexpected outbound connections from systems running Open Babel
- File uploads to systems with Open Babel
SIEM Query:
Process:obabel AND (EventID:1000 OR EventID:1001) OR FileExtension:pqs