CVE-2022-46291
📋 TL;DR
CVE-2022-46291 is a critical out-of-bounds write vulnerability in Open Babel's MSI file format parser that allows arbitrary code execution when processing malicious files. This affects Open Babel 3.1.1 and development versions, potentially impacting any system using Open Babel for chemical file format conversion. Attackers can exploit this by providing specially crafted MSI files to vulnerable systems.
💻 Affected Systems
- Open Babel
📦 What is this software?
Open Babel by Openbabel
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution leading to complete data loss, lateral movement, and persistent backdoor installation.
Likely Case
Local privilege escalation or remote code execution when users process untrusted MSI files through Open Babel.
If Mitigated
Denial of service or application crash if memory protections prevent code execution.
🎯 Exploit Status
Exploitation requires user interaction to process malicious file; Talos Intelligence has published technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Open Babel 3.1.2 or later
Vendor Advisory: https://github.com/openbabel/openbabel/security/advisories
Restart Required: Yes
Instructions:
1. Update Open Babel to version 3.1.2 or later. 2. Rebuild any applications using Open Babel libraries. 3. Restart services using Open Babel.
🔧 Temporary Workarounds
Disable MSI format support
allRemove or disable MSI file format parsing in Open Babel configuration
Modify Open Babel configuration to exclude MSI format support
Input validation
allImplement strict file validation before processing with Open Babel
🧯 If You Can't Patch
- Implement application sandboxing to limit Open Babel's system access
- Use file type filtering to block MSI files from being processed by Open Babel
🔍 How to Verify
Check if Vulnerable:
Check Open Babel version: 'obabel --version' or examine installed package versionCheck Version:
obabel --versionVerify Fix Applied:
Confirm version is 3.1.2 or later and test with known safe MSI files📡 Detection & Monitoring
Log Indicators:
- Open Babel process crashes when parsing files
- Unexpected child processes spawned from Open Babel
Network Indicators:
- Unusual outbound connections from systems running Open Babel
SIEM Query:
Process:obabel AND (EventID:1000 OR ParentProcess:obabel)