CVE-2022-50925
📋 TL;DR
CVE-2022-50925 is a remote keystroke injection vulnerability in Prowise Reflect version 1.0.9 that allows attackers to send keyboard events through an exposed WebSocket on port 8082. Attackers can craft malicious web pages to inject keystrokes, potentially opening applications and typing arbitrary text. This affects users running the vulnerable version of Prowise Reflect software.
💻 Affected Systems
- Prowise Reflect
📦 What is this software?
Reflect by Prowise
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution by opening malicious applications and executing commands through keystroke injection.
Likely Case
Unauthorized application access, data theft, or system manipulation through injected keystrokes.
If Mitigated
Limited impact if WebSocket access is blocked or software is patched.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB, requiring only web browser access to malicious page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.0.10 or later
Vendor Advisory: https://www.prowise.com/
Restart Required: Yes
Instructions:
1. Download latest version from Prowise website. 2. Uninstall current version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Block WebSocket Port
allBlock access to port 8082 using firewall rules to prevent WebSocket communication.
sudo iptables -A INPUT -p tcp --dport 8082 -j DROP
netsh advfirewall firewall add rule name="Block Prowise WS" dir=in action=block protocol=TCP localport=8082
Disable WebSocket Service
allDisable or stop the Prowise Reflect WebSocket service.
sudo systemctl stop prowisereflect
sc stop "Prowise Reflect"
🧯 If You Can't Patch
- Network segmentation: Isolate systems running Prowise Reflect from untrusted networks.
- Application control: Restrict which applications can be launched via keystroke injection.
🔍 How to Verify
Check if Vulnerable:
Check if Prowise Reflect version 1.0.9 is installed and port 8082 is listening: netstat -an | findstr 8082 or ss -tlnp | grep 8082Check Version:
Check application about dialog or installed programs list for version number.Verify Fix Applied:
Verify version is 1.0.10 or later and port 8082 is no longer exposed or properly secured.📡 Detection & Monitoring
Log Indicators:
- Unusual WebSocket connections on port 8082
- Unexpected application launches
Network Indicators:
- WebSocket traffic to port 8082 from external sources
- Malformed WebSocket messages
SIEM Query:
source_port=8082 AND protocol=websocket AND (src_ip NOT IN internal_range)