CVE-2022-46280

What it actually does

Use of an uninitialized pointer in PQS format pFormat handling allows a specially crafted malformed file to trigger arbitrary code execution via memory corruption.

Why it matters to the business

Successful exploitation grants attackers full control over affected systems processing untrusted files, enabling data theft, ransomware deployment, or lateral movement. With an exploit publicly available more than three years after disclosure, organizations depending on the vulnerable component face persistent targeted attack risk.

How an attack unfolds

An attacker crafts a malicious PQS file that triggers the uninitialized pointer dereference and delivers it via email, web download, or shared storage. When a victim opens the file using the vulnerable application, the flaw is triggered and attacker-controlled code executes with the privileges of the process.

How to fix it

Upgrade github.com/rancher/rancher to version 2.0.16, 2.1.11, or 2.2.5. Remove or isolate any remaining instances of the vulnerable Open Babel 3.1.1 component from build pipelines and runtime environments.

How to confirm the fix worked

Confirm the installed package version matches one of the fixed releases, recompile dependent applications, and test file ingestion with known malformed PQS samples in a controlled environment to verify the pointer issue no longer occurs.

Typical attack path

1. Craft a malformed PQS file exploiting the uninitialized pointer
2. Deliver the file to the target environment through phishing, downloads, or file shares
3. Induce the victim to open the file with the vulnerable application
4. Trigger memory corruption leading to arbitrary code execution

How to detect it

Review application and system logs for crashes or unexpected child process creation immediately after PQS file processing. Correlate file-open events with subsequent privilege escalation or network activity.

What your security team should do

• Prioritize upgrade to a fixed Rancher version within 30 days given public exploit availability
• Audit all build and runtime dependencies for Open Babel 3.1.1 usage
• Implement application allow-listing for file parsers and restrict opening of untrusted PQS files
• Update detection rules to monitor for anomalous process behavior during file handling