CVE-2022-47184 – Apache Traffic Server versions 8.0.0 through 9.... (How to Fix)

Q: What is the severity of CVE-2022-47184?

CVE-2022-47184 has a CVSS score of 7.5 (HIGH). Apache Traffic Server versions 8.0.0 through 9.2.0 contain an information disclosure vulnerability that allows unauthorized actors to access sensitive information. This affects all deployments running vulnerable versions of the caching proxy server. The vulnerability exposes internal data that should not be accessible to external users.

📋 TL;DR

Apache Traffic Server versions 8.0.0 through 9.2.0 contain an information disclosure vulnerability that allows unauthorized actors to access sensitive information. This affects all deployments running vulnerable versions of the caching proxy server. The vulnerability exposes internal data that should not be accessible to external users.

💻 Affected Systems

Products:

Apache Traffic Server

Versions: 8.0.0 to 9.2.0

Operating Systems: All platforms running Apache Traffic Server

Default Config Vulnerable: ⚠️ Yes

Notes: All configurations of affected versions are vulnerable; no special configuration required for exploitation.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could access sensitive configuration data, internal network information, or cached credentials, potentially leading to further system compromise.

🟠

Likely Case

Unauthorized access to internal server information, configuration details, or metadata that could aid in reconnaissance for further attacks.

🟢

If Mitigated

Limited exposure of non-critical information with proper network segmentation and access controls in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability allows information disclosure without authentication, making it relatively easy to exploit.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 9.2.1 and later

Vendor Advisory: https://lists.apache.org/thread/tns2b4khyyncgs5v5p9y35pobg9z2bvs

Restart Required: Yes

Instructions:

1. Download Apache Traffic Server 9.2.1 or later from the official Apache website. 2. Stop the Traffic Server service. 3. Install the updated version. 4. Restart the Traffic Server service.

🔧 Temporary Workarounds

Network Access Restriction

linux

Restrict network access to Traffic Server to only trusted sources

iptables -A INPUT -p tcp --dport 8080 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP

🧯 If You Can't Patch

Implement strict network segmentation to limit access to Traffic Server instances
Deploy web application firewall rules to detect and block information disclosure attempts

🔍 How to Verify

Check if Vulnerable:

Check the Traffic Server version: traffic_server -v

Check Version:

traffic_server -v

Verify Fix Applied:

Verify version is 9.2.1 or later: traffic_server -v | grep -E '9\.2\.[1-9]|9\.[3-9]|1[0-9]'

📡 Detection & Monitoring

Log Indicators:

Unusual access patterns to non-standard endpoints
Requests resulting in information disclosure responses

Network Indicators:

Unusual traffic patterns to Traffic Server on standard ports
Requests that trigger information disclosure

SIEM Query:

source="traffic_server" AND (status=200 OR status=403) AND uri CONTAINS "/internal/" OR uri CONTAINS "/config/"

📊 Metadata

CVE ID: CVE-2022-47184

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-200

Published: June 14, 2023

Last Updated: February 13, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-47184, you might also want to check these: