JustSystems JUST Online Update for J-License': Unquoted Search Path or Element
CVE-2022-36344 is a critical-severity unquoted search path or element vulnerability in JustSystems JUST Online Update for J-License' from JustSystems, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. There is no confirmed exploitation so far. EPSS estimates a 0.9% chance of exploitation within 30 days, higher than 60% of scored CVEs.
Critical severity: a successful attack would have severe impact.
What to do
- Check which version of JustSystems JUST Online Update for J-License' you run against the affected versions below, and install the vendor's latest release.
- Read the advisory on justsystems.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| JustSystems | JustSystems JUST Online Update for J-License' | Not specified in the record | Not stated |
| Justsystems | Atok Medical 2 | Not specified in the record | Not stated |
| Justsystems | Atok Medical 3 | Not specified in the record | Not stated |
| Justsystems | Atok Pro 3 | Not specified in the record | Not stated |
| Justsystems | Atok Pro 4 | Not specified in the record | Not stated |
| Justsystems | Atok Pro 5 | Not specified in the record | Not stated |
| Justsystems | Hanako Police 5 | Not specified in the record | Not stated |
| Justsystems | Hanako Police 6 | Not specified in the record | Not stated |
| Justsystems | Hanako Police 7 | Not specified in the record | Not stated |
| Justsystems | Hanako Pro 3 | Not specified in the record | Not stated |
| Justsystems | Hanako Pro 4 | Not specified in the record | Not stated |
| Justsystems | Hanako Pro 5 | Not specified in the record | Not stated |
| Justsystems | Homepage Builder 20 | Not specified in the record | Not stated |
| Justsystems | Homepage Builder 21 | Not specified in the record | Not stated |
| Justsystems | Homepage Builder 22 | Not specified in the record | Not stated |
| Justsystems | Ichitaro Government 10 | Not specified in the record | Not stated |
| Justsystems | Ichitaro Government 8 | Not specified in the record | Not stated |
| Justsystems | Ichitaro Government 9 | Not specified in the record | Not stated |
| Justsystems | Ichitaro Pro 3 | Not specified in the record | Not stated |
| Justsystems | Ichitaro Pro 4 | Not specified in the record | Not stated |
| Justsystems | Ichitaro Pro 5 | Not specified in the record | Not stated |
| Justsystems | Just Calc 3 | Not specified in the record | Not stated |
| Justsystems | Just Calc 4 | Not specified in the record | Not stated |
| Justsystems | Just Calc 5 | Not specified in the record | Not stated |
| Justsystems | Just Focus 3 | Not specified in the record | Not stated |
Version data comes from the organisation that assigned the CVE; 35 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
Official description
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
How developers prevent this class of flaw
- Properly quote the full search path before executing a program on the system.
- Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
More Unquoted Search Path or Element vulnerabilities (CWE-428)
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Third-party and government advisories
- jvn.jp/en/jp/JVN57073973/index.htmlThird Party Advisory
Recent Unquoted Search Path or Element vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.2 High severity
- 7.8 High severity
Spotted an error? Tell us.