1Panel-dev KubePi up to 1.7.x Configuration File improper restriction of security token assignment

Summaryinfo

A vulnerability was found in 1Panel-dev KubePi up to 1.7.x. It has been declared as critical. The affected element is an unknown function of the component Configuration File Handler. Such manipulation leads to improper restriction of security token assignment. This vulnerability is uniquely identified as CVE-2024-36111. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in 1Panel-dev KubePi up to 1.7.x. Affected by this issue is some unknown processing of the component Configuration File Handler. The manipulation with an unknown input leads to a improper restriction of security token assignment vulnerability. Using CWE to declare the problem leads to CWE-1259. The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected. Impacted is confidentiality, integrity, and availability. CVE summarizes:

KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the key is detected to be empty in the configuration file reading logic, the key is empty during actual verification. Using an empty key to generate a JWT token can bypass the login verification and directly take over the back end. Version 1.8.0 contains a patch for this issue.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-36111 since 05/20/2024. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1134.001.

Upgrading to version 1.8.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• 1Panel-dev

Name

• KubePi

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7

Website

• Product: https://github.com/1Panel-dev/KubePi/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion