CVE-2022-24637 — Open Web Analytics (prior to 1.7.4)

Defensive notes on a critical unauthenticated information-disclosure issue in Open Web Analytics (OWA) that can lead to privilege escalation.

Encountered while working the Fruityloops box on echoCTF, which ran Open Web Analytics 1.7.3.

Summary

Field	Detail
CVE	CVE-2022-24637
Product	Open Web Analytics
Affected	Versions before 1.7.4 (including 1.7.3)
Fixed in	1.7.4 and later
Severity	Critical
Advisory	GHSA-pr9q-v585-qv2w

Unauthenticated remote attackers can obtain sensitive user information from OWA’s cache handling. That data can be abused to escalate to administrative privileges. In some cases this has been chained further to compromise the host.

Impact

• Exposure of sensitive account-related data
• Path to admin privilege escalation
• Broader compromise if chained with other weaknesses

Mitigation

1. Upgrade Open Web Analytics to 1.7.4 or newer. This is the primary fix.
2. Restrict access to cache and other sensitive data directories so they are not served as static files over HTTP.
3. Clear existing caches after patching so previously generated artifacts are not left exposed.
4. Review admin accounts, rotate credentials/API keys if exposure is suspected, and check logs for abuse.

References

• NVD — CVE-2022-24637
• GitHub Advisory GHSA-pr9q-v585-qv2w
• Wiz vulnerability summary
• Open Web Analytics release notes / upgrade path for 1.7.4+

Scope of this repository

This repository documents the CVE for awareness and remediation only. It does not include exploit code, payloads, or reproduction steps.