CVE-2022-46293
📋 TL;DR
CVE-2022-46293 is a critical out-of-bounds write vulnerability in Open Babel's MOPAC file parser that allows arbitrary code execution when processing malicious files. This affects users of Open Babel 3.1.1 and development versions who process untrusted MOPAC format files. Attackers can achieve remote code execution by tricking users or automated systems into opening specially crafted files.
💻 Affected Systems
- Open Babel
📦 What is this software?
Open Babel by Openbabel
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the Open Babel process, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Remote code execution on systems processing untrusted MOPAC files, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
If Mitigated
Limited impact through proper file validation, sandboxing, and privilege reduction, potentially reducing to denial of service or information disclosure.
🎯 Exploit Status
Exploitation requires the victim to process a malicious MOPAC file. The vulnerability is in file parsing, so no authentication is needed beyond file access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Open Babel 3.1.2 or later
Vendor Advisory: https://github.com/openbabel/openbabel/security/advisories/GHSA-6w4m-7w8q-2v3q
Restart Required: No
Instructions:
1. Update Open Babel to version 3.1.2 or later. 2. If using package manager, run appropriate update command. 3. If compiled from source, download latest release and rebuild.
🔧 Temporary Workarounds
Disable MOPAC file processing
allConfigure Open Babel to reject or skip MOPAC format files
# Configure application to filter out .mop files
# Use file type validation before processing
Sandbox execution
linuxRun Open Babel in a container or sandbox with limited privileges
docker run --read-only --cap-drop=ALL -v /safe/input:/input openbabel
# Or use AppArmor/SELinux profiles
🧯 If You Can't Patch
- Implement strict file validation: only allow trusted, verified MOPAC files
- Run Open Babel with minimal privileges (non-root user, restricted filesystem access)
🔍 How to Verify
Check if Vulnerable:
Check Open Babel version: 'obabel --version'. If version is 3.1.1 or development version with commit earlier than fix, system is vulnerable.Check Version:
obabel --versionVerify Fix Applied:
Verify version is 3.1.2 or later: 'obabel --version' should show patched version. Test with known safe MOPAC files to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Multiple failed MOPAC file parsing attempts
- Unusual process spawning from Open Babel
- Memory access violations in application logs
Network Indicators:
- Unexpected outbound connections from Open Babel process
- File downloads followed by Open Babel execution
SIEM Query:
process_name:"obabel" AND (file_extension:".mop" OR file_type:"MOPAC")