External risk intelligence

ESPCMS Remote Code Execution in IS_GETCACHE Component

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-44089

ESPCMS is a content management system designed to be deployed as a public-facing web application. Since it is a web-based platform intended to host content accessible to internet users, the underlying components and services are commonly exposed to the public internet in standard deployment configurations.

Code Injection

Ecisp Espcms

p8.21120101

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in ESPCMS affects its remote code execution component. It allows for unauthenticated attackers to execute arbitrary code, which could have significant security implications for systems using this software. The main concern is confirming relevance and exposure.

Code execution flaw found in ESPCMS.
Critical issue allowing unauthenticated code execution.
Confirm relevance and exposure to affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a publicly accessible ESPCMS web application. The IS_GETCACHE component, which handles caching, is susceptible to this flaw. If successful, an attacker could achieve remote code execution, allowing them to take control of the server.

Publicly accessible web application.
Specially crafted request to IS_GETCACHE.
Remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

The ESPCMS component IS_GETCACHE, when deployed publicly, could allow an unauthenticated attacker to execute arbitrary code on the server. This could impact the integrity and availability of the affected system.

Remote code execution on the server.
Exploited via a network request.
System compromise and data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ESPCMS platform, particularly version P8.21120101, presents a critical remote code execution risk, likely due to its nature as a public-facing web application. The initial focus should be on identifying all instances of ESPCMS, assessing their exposure and business criticality, and locating the system owners responsible for remediation. A risk-based approach to planning the fix, potentially involving vendor coordination or temporary mitigation, is crucial before initiating broader changes.

ESPCMS application owners.
Verify external reachability and criticality.
Plan remediation and coordinate with vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ESPCMS and what is it used for?

ESPCMS is a content management system (CMS) designed to help users build and maintain websites. It provides the framework for managing digital content and is typically deployed as a web application intended to be accessible to visitors over the internet.

What does the CVE-2022-44089 vulnerability mean?

This vulnerability is classified as Improper Control of Generation of Code (CWE-94). In plain terms, it means the software's IS_GETCACHE component does not properly sanitize input, allowing an attacker to inject and execute their own unauthorized code on the server, resulting in Remote Code Execution.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specifically crafted network request to the vulnerable IS_GETCACHE component. The vulnerability is not triggered by standard, legitimate user interactions; it requires the submission of malicious input designed to exploit the cache handling process.

Do I need to worry if my ESPCMS instance is internal?

According to Halo Surface Signal, ESPCMS is typically deployed as a public-facing application, making it a primary target for external actors. If your instance is truly isolated from the public internet, the risk is significantly lower than for publicly reachable installations.

When should I take action to address this CVE?

You should prioritize this immediately because it is a critical vulnerability. Start by identifying all instances of ESPCMS within your environment, verifying which are exposed to the internet, and coordinating with your system owners to plan a path toward applying the necessary vendor updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.