Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-31115

CVE-2022-31115: opensearch-ruby 2.x before 2.0.2 vulnerable to unsafe YAML deserialization

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-31115
GHSA ID
GHSA-977c-63xq-cgw3
EPSS Score
0.39573%
CWE
CWE-502
Published
7/5/2022
Updated
3/31/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
opensearch-rubyrubygems>= 2.0.0, < 2.0.22.0.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the use of YAML.load instead of YAML.safe_load in two locations. The GitHub commit diff explicitly shows these functions being patched. YAML.load is inherently unsafe for untrusted input due to its ability to deserialize arbitrary Ruby objects, which aligns with CWE-502 (Deserialization of Untrusted Data). The linked advisory and supporting references confirm this pattern as the root cause.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t * Y*ML **s*ri*liz*tion in op*ns**r**-ru*y *.*.* **n l*** to uns*** **s*ri*liz*tion usin* Y*ML.lo** i* t** r*spons* is o* typ* Y*ML. ### P*t***s T** pro*l*m **s ***n p*t**** in op*ns**r**-ru*y **m v*rsion *.*.*. ### Work*roun*s No vi**l*

Reasoning

T** vuln*r**ility st*ms *rom t** us* o* `Y*ML.lo**` inst*** o* `Y*ML.s***_lo**` in two lo**tions. T** *it*u* *ommit *i** *xpli*itly s*ows t**s* *un*tions **in* p*t****. `Y*ML.lo**` is in**r*ntly uns*** *or untrust** input *u* to its **ility to **s*ri