CVE-2022-47986

CVE-2022-47986: IBM Aspera Faspex YAML Deserialization RCE

AI-generated analysis based on the vulnerability data on this page.

Summary

A YAML deserialization vulnerability in IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier allows unauthenticated remote attackers to execute arbitrary code on the target system by sending a specially crafted request to an obsolete API endpoint.

Background

IBM Aspera Faspex is a centralized file-exchange solution built on Aspera's high-speed transfer technology. It is widely deployed in enterprise and media workflows to send and receive large files. Faspex exposes several API endpoints for automation and integration; one such endpoint was deprecated but remained reachable in versions prior to 4.4.2 Patch Level 2, creating an unauthenticated attack surface.

Root Cause

The vulnerability is classified under CWE-502: Deserialization of Untrusted Data. The obsolete API call accepted YAML payloads without adequate validation or sanitization. When an attacker supplies a malicious YAML document containing embedded object deserialization directives, the Faspex application processes it through a YAML parser configured to instantiate arbitrary objects. This leads to immediate remote code execution because the attacker can control the class and arguments being instantiated.

Impact

The CVSS 3.1 score of 9.8 (Critical) reflects the worst-case network exposure:

• Attack Vector (AV): Network — exploitable remotely without network segmentation bypasses.
• Attack Complexity (AC): Low — no special conditions or race windows are required.
• Privileges Required (PR): None — the vulnerable endpoint is reachable without authentication.
• User Interaction (UI): None — fully automated exploitation.
• Scope (S): Unchanged — impact remains within the vulnerable component.
• Confidentiality (C): High — complete data disclosure.
• Integrity (I): High — arbitrary modification of data or system state.
• Availability (A): High — system can be rendered unavailable or repurposed by the attacker.

Successful exploitation grants the attacker full control over the Faspex host with the privileges of the application service account.

Exploitation Walkthrough

Ethics caveat: The following description is provided for defensive awareness only. No weaponized exploit code is included, and the obsolete endpoint was removed by the vendor in the patched release.

1. Reconnaissance — The attacker identifies a Faspex instance running version 4.4.2 PL1 or earlier (e.g., via banner extraction, exposed /aspera/faspex paths, or public asset discovery).
2. Endpoint probing — The attacker sends benign requests to the obsolete API route to confirm reachability. A valid but minimal YAML payload may be used to verify that the endpoint parses YAML rather than JSON or XML.
3. Deserialization trigger — The attacker crafts a YAML payload that leverages the underlying parser's object-instantiation capabilities. In typical Ruby-based YAML parsers (common in Faspex's stack), this involves supplying a serialized object with a chosen class and attacker-controlled initialization arguments.
4. Code execution — The instantiated object executes attacker-supplied logic during initialization or finalization, yielding a shell or reverse connection back to the attacker.

Defenders should treat any Faspex instance older than 4.4.2 PL2 as compromised until proven otherwise if it is internet-facing, given the EPSS score and confirmed in-the-wild exploitation.

Affected and Patched Versions

The vendor removed the obsolete API call entirely in Patch Level 2, eliminating the attack surface rather than adding input validation alone.

Remediation

1. Upgrade immediately — Apply IBM Aspera Faspex 4.4.2 Patch Level 2 (or the latest available release from IBM's support portal). The obsolete API is removed in this version.
2. Compensating controls (if upgrade is delayed):
   • Place the Faspex management interface behind a VPN or IP-restricted jump host; do not expose it directly to the internet.
   • Deploy a Web Application Firewall (WAF) rule to block requests to the obsolete API path based on known URL patterns and YAML content-type indicators.
   • Monitor for anomalous YAML payloads in HTTP request bodies.
   • Reduce the service account privileges of the Faspex application to limit post-exploitation lateral movement.

Detection

• Network signatures — Monitor HTTP POST requests to legacy API paths that carry Content-Type values associated with YAML (application/x-yaml, text/yaml, or text/x-yaml).
• Host indicators — Unexpected child processes spawned by the Faspex application server (e.g., /bin/sh, powershell.exe, or scripting interpreters) are strong indicators of successful exploitation.
• File integrity — Review web server and application logs for 200 OK responses to the obsolete endpoint from unexpected source IPs.
• Threat-intel correlation — Cross-reference source IPs against CISA KEV and EUVD advisories for this CVE.

Assessment

With an EPSS of 0.99968 and confirmed inclusion in the CISA Known Exploited Vulnerabilities catalog since 2023-02-21, this flaw is not theoretical—attackers have been actively abusing it in the wild for over two years. The near-perfect EPSS percentile places it in the top fraction of a percent of all CVEs by probability of exploitation.

Key lessons:

1. Remove deprecated endpoints — Input validation alone is insufficient; unused or obsolete APIs should be disabled or removed in security patches to shrink the attack surface.
2. Deserialization is a critical control point — Any endpoint that parses serialized data formats (YAML, JSON, XML, Java serialized objects) must use strictly typed schemas and reject unexpected object types.

References

• http://packetstormsecurity.com/files/171772/IBM-Aspera-Faspex-4.4.1-YAML-Deserialization.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/243512
• https://www.ibm.com/support/pages/node/6952319
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-47986