CVE-2022-47878
📋 TL;DR
This vulnerability allows authenticated remote attackers to set the default storage path to the webroot directory in Jedox installations. Subsequent file uploads can lead to remote code execution. It affects on-premises deployments of Jedox version 22.2 and earlier, but not cloud-hosted or SaaS environments.
💻 Affected Systems
- Jedox
📦 What is this software?
Jedox by Jedox
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution, allowing attackers to execute arbitrary commands, steal data, deploy ransomware, or pivot to other systems.
Likely Case
Unauthorized file upload leading to web shell deployment, data exfiltration, or lateral movement within the network.
If Mitigated
Limited impact with proper access controls, but potential for privilege escalation if initial access is gained.
🎯 Exploit Status
Exploitation requires authenticated access. Public proof-of-concept exists showing the attack chain from path manipulation to RCE.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 22.3 and later
Vendor Advisory: https://jedox.mantishub.io/app/issues/57238
Restart Required: Yes
Instructions:
1. Backup current Jedox installation and data. 2. Download Jedox version 22.3 or later from official vendor portal. 3. Follow vendor upgrade documentation for your specific deployment. 4. Restart Jedox services after upgrade. 5. Verify functionality post-upgrade.
🔧 Temporary Workarounds
Restrict Storage Path Configuration
allImplement access controls to prevent unauthorized users from modifying storage path settings in the settings page.
Configure role-based access control to limit 'settings' page access to administrators only
Webroot Directory Protection
allImplement file system permissions to prevent writing to webroot directory from Jedox application.
chmod 755 /var/www/html (Linux example)
icacls C:\inetpub\wwwroot /deny jedoxuser:W (Windows example)
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jedox servers from critical systems
- Deploy web application firewall (WAF) rules to detect and block path manipulation attempts
🔍 How to Verify
Check if Vulnerable:
Check Jedox version via admin interface or configuration files. Versions 22.2 or earlier are vulnerable.Check Version:
Check Jedox version in admin panel or review installation logs for version informationVerify Fix Applied:
Verify version is 22.3 or later via admin dashboard and test that storage path cannot be set to webroot directory.📡 Detection & Monitoring
Log Indicators:
- Unauthorized modifications to storage path settings
- File uploads to unusual directories (especially webroot)
- Execution of unexpected system commands from Jedox process
Network Indicators:
- Outbound connections from Jedox server to unknown IPs
- Unusual file upload patterns to Jedox server
SIEM Query:
source="jedox" AND (event="settings_modified" OR event="file_upload" AND path="*webroot*")🔗 References
- http://packetstormsecurity.com/files/172154/Jedox-2020.2.5-Configurable-Storage-Path-Remote-Code-Execution.html
- https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf
- https://jedox.mantishub.io/app/issues/57238
- http://packetstormsecurity.com/files/172154/Jedox-2020.2.5-Configurable-Storage-Path-Remote-Code-Execution.html
- https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf
