Improper Privilege Management in tooljet/tooljet

The core of this vulnerability lies in the insecure handling of password storage and the forgotten password reset process within Tooljet. An attacker can potentially obtain password hashes, which, if cracked, would grant them direct access to user accounts. Furthermore, the forgotten password token mechanism is vulnerable, allowing an attacker to intercept or manipulate tokens to reset passwords and gain control of accounts without user interaction. The blast radius extends to any data accessible within Tooljet, including sensitive business information, user credentials, and potentially integration keys for connected services. This vulnerability is particularly concerning given the increasing sophistication of password cracking techniques and the prevalence of account takeover attacks.

Organizations using Tooljet for data visualization and workflow automation are at risk, particularly those relying on default configurations or lacking robust password policies. Shared hosting environments where multiple Tooljet instances are deployed on the same infrastructure are also at increased risk, as a compromise of one instance could potentially lead to the compromise of others.

• linux / server:

journalctl -u tooljet | grep -i "password reset"

• generic web:

curl -I https://<tooljet_url>/forgot-password

Inspect the response headers for any unusual or unexpected behavior. • generic web:

 grep -r "password_reset_token" /var/log/nginx/access.log

Look for patterns indicating potential token manipulation.

1. 2022-10-07Disclosure

   disclosure

1. Réservé2022-10-07
2. Publiée2022-10-07
3. Modifiée2024-08-03
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2022-3422 is to immediately upgrade Tooljet to version v1.26.1 or later. If upgrading is not immediately feasible due to compatibility concerns or downtime requirements, consider implementing temporary workarounds. Review and strengthen password policies, enforcing strong passwords and multi-factor authentication where possible. Monitor Tooljet logs for suspicious activity, particularly related to password reset requests and failed login attempts. While a direct WAF rule is unlikely to prevent the underlying vulnerability, rate limiting password reset requests could help mitigate automated exploitation attempts. There are no specific Sigma or YARA rules readily available for this vulnerability, emphasizing the importance of upgrading.