External risk intelligence

Netaxis API Orchestrator Server Side Template Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-23851

The Netaxis API Orchestrator is designed to manage and orchestrate APIs. Such products are typically deployed as edge services or gateways to facilitate API traffic, making them commonly reachable from the network or internet in their intended operational role.

Netaxis Api Orchestrator

before 0.19.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in Netaxis API Orchestrator, a technology used for managing and orchestrating APIs. This issue could potentially allow unauthorized access and control over systems. The main concern is to confirm if our organization utilizes this specific technology and assess any potential exposure.

Allows attackers to inject code into systems.
Important for potential unauthorized system access.
Confirm if this technology is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to the Netaxis API Orchestrator. Because the product is designed for API traffic and commonly exposed externally, an unauthenticated attacker could target its template processing feature. Successful exploitation could allow an attacker to inject malicious code, leading to the compromise of the server.

No authentication required.
Inject code via API requests.
Server-side code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Netaxis API Orchestrator could allow an attacker to inject malicious code through crafted API requests, potentially leading to the execution of arbitrary commands on the server. When this is supported, sensitive system data and configurations could be exposed or altered.

Server-side code and configurations at risk.
Via unauthenticated network requests.
Unauthorized code execution and data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Netaxis API Orchestrator, allowing server-side template injection, impacts systems exposed to the network. The first practical move is to identify where the API Orchestrator is deployed, assess its exposure and business criticality, and locate the accountable owner. This understanding will inform the remediation plan based on risk.

Own the issue: Application or Platform teams.
Verify first: API Orchestrator external reachability.
Action: Plan and coordinate upgrade or patch.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Netaxis API Orchestrator?

Netaxis API Orchestrator (APIO) is a software platform designed to manage, route, and orchestrate API traffic. Organizations typically use it as a centralized gateway or middleware to streamline communications between different services and manage API lifecycles, often acting as a critical junction for incoming and outgoing data requests.

What does CVE-2022-23851 mean by server-side template injection?

This vulnerability, classified as CWE-1336, occurs when an application unsafely processes user-provided data within a template engine. Instead of just displaying the input, the software mistakenly interprets the data as executable code. In the context of CVE-2022-23851, this allows an attacker to manipulate the template logic to execute arbitrary commands directly on the host server.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specifically crafted API requests to the application that are designed to be processed by the vulnerable template engine. It is important to note that this does not require a legitimate user account; the vulnerability is triggered through unauthenticated network requests that exploit the way the system interprets incoming data structures.

Is my organization likely at risk from this CVE?

Halo Surface Signal indicates that because the API Orchestrator is designed to manage API traffic, it is frequently deployed as an edge service or gateway. These roles often require the software to be reachable from the network or the public internet, which significantly increases the likelihood that your instance is exposed to external probes or attacks.

What should I do if I run this software?

Your priority is to inventory your environment to locate all instances of Netaxis API Orchestrator. Once identified, work with the relevant application or platform owners to verify the software version in use. If your version is earlier than 0.19.3, coordinate with your team to plan and apply the necessary patches or upgrades provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.