KubeVela up to 1.4.10/1.5.3 VelaUX APIServer getSystemInfo platformID authentication replay

Summaryinfo

A vulnerability labeled as critical has been found in KubeVela up to 1.4.10/1.5.3. This affects the function getSystemInfo of the component VelaUX APIServer. Such manipulation of the argument platformID leads to authentication replay. This vulnerability is documented as CVE-2022-36089. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in KubeVela up to 1.4.10/1.5.3. It has been rated as critical. Affected by this issue is the function getSystemInfo of the component VelaUX APIServer. The manipulation of the argument platformID with an unknown input leads to a authentication replay vulnerability. Using CWE to declare the problem leads to CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). Impacted is confidentiality, integrity, and availability. CVE summarizes:

KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the `PlatformID` as the signed key to generate the JWT tokens for users. Another API called `getSystemInfo` exposes the platformID. This vulnerability allows users to use the platformID to re-generate the JWT tokens to bypass the authentication. Versions 1.4.11 and 1.5.4 contain a patch for this issue.

The weakness was released 09/08/2022 as GHSA-cq42-w295-r29q. The advisory is available at github.com. This vulnerability is handled as CVE-2022-36089 since 07/15/2022. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1040 by the MITRE ATT&CK project.

Upgrading to version 1.4.11 or 1.5.4 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• KubeVela

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6
• 1.4.7
• 1.4.8
• 1.4.9
• 1.4.10
• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3

Website

• Product: https://github.com/kubevela/kubevela/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion