project-zot up to 2.0.x OCI Image GetBlob authorization

Summaryinfo

A vulnerability identified as problematic has been detected in project-zot zot up to 2.0.x. Affected by this issue is the function GetBlob of the component OCI Image Handler. Performing a manipulation results in authorization. This vulnerability is cataloged as CVE-2024-39897. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in project-zot zot up to 2.0.x. This affects the function GetBlob of the component OCI Image Handler. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on confidentiality. The summary by CVE is:

zot is an OCI image registry. Prior to 2.1.0, the cache driver `GetBlob()` allows read access to any blob without access control check. If a Zot `accessControl` policy allows users read access to some repositories but restricts read access to other repositories and `dedupe` is enabled (it is enabled by default), then an attacker who knows the name of an image and the digest of a blob (that they do not have read access to), they may maliciously read it via a second repository they do have read access to. This attack is possible because [`ImageStore.CheckBlob()` calls `checkCacheBlob()`](https://github.com/project-zot/zot/blob/v2.1.0-rc2/pkg/storage/imagestore/imagestore.go#L1158-L1159) to find the blob a global cache by searching for the digest. If it is found, it is copied to the user requested repository with `copyBlob()`. The attack may be mitigated by configuring "dedupe": false in the "storage" settings. The vulnerability is fixed in 2.1.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2024-39897 since 07/02/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

Upgrading to version 2.1.0 eliminates this vulnerability. Applying the patch aaee0220e46bdadd12115ac67c19f9d3153eb1df is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Project Management Software

Vendor

• project-zot

Name

• zot

Version

• 2.0

License

• open-source

Website

• Product: https://github.com/project-zot/zot/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion