Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
http://kube.pi/kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password of any user (including admin). This leads to password crack attack PoC https://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview Impact - Leaking confidential information. - Can lead to password cracking attacks
Recommended action: Upgrade to 1.6.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request PoC Change the value of the isadmin field in the request to true: https://drive.google.com/file/d/1e8XJbIFIDXaFiL-dqn0a0b6u7o3CwqSG/preview Impact Elevate user privileges
Recommended action: Upgrade to 1.6.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A session fixation attack allows an attacker to hijack a legitimate user session. The attack investigates a flaw in how the online application handles the session ID, especially the susceptible web application. Affected Version <= v1.6.3 Patches The vulnerability has been fixed in v1.6.4. https://github.com/KubeOperator/KubePi/commit/1e9c550356c1a425a742480efcf743d373e98dcb : A session fixation attack allows an attacker to hijack a legitimate user session. Workarounds It is recommended to upgrade the version to v1.6.4. For more information If you have any questions or comments about this advisory, please open an issue. This vulnerability is reported by sachinh09 from huntr.dev.
Recommended action: Upgrade to 1.6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unauthorized access refers to the ability to bypass the system's preset permission settings to access some API interfaces. The attack exploits a flaw in how online applications handle routing permissions. Affected Version <= v1.6.3 Patches The vulnerability has been fixed in v1.6.4. https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6 Workarounds It is recommended to upgrade the version to v1.6.4. For more information If you have any questions or comments about this advisory, please open an issue. References https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4
Recommended action: Upgrade to 1.6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The jwt authentication function of kubepi <= v1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Details session.go, the use of hard-coded JwtSigKey allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. Affected Version <= v1.6.2 Patches The vulnerability has been fixed in v1.6.3. https://github.com/KubeOperator/KubePi/commit/3be58b8df5bc05d2343c30371dd5fcf6a9fbbf8b : JWT key can be specified in app.yml, if leave it blank a random key will be used. Workarounds It is recommended to upgrade the version to v1.6.3. For more information If you have any questions or comments about this advisory, please open an issue.
Recommended action: Upgrade to 1.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.