CVE-2020-1764: High severity Kiali Kiali vulnerability
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.
Other sources
A vulnerability was found in Kiali v1.9 where the default signing key for JWT cookies is known in the source. A session can be spoofed without user information and the authentication mechanism of Kiali bypassed.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/kiali/kialito a version that resolves this vulnerability.Fixed in 1.15.1 - Upgrade
Upgrade
redhat/kialito a version that resolves this vulnerability.Fixed in 1.15.1 - Upgrade
Upgrade
Kialito a version that resolves this vulnerability.Fixed in 1.15.1 - Operational
After upgrading, rotate/reissue any JWT cookies/session artifacts and clear existing sessions so attackers cannot reuse spoofed JWTs created with the known default signing key.
Event History
Frequently Asked Questions
What is CVE-2020-1764?
CVE-2020-1764 is a hard-coded cryptographic key vulnerability in the default configuration file found in Kiali.
What is the severity of CVE-2020-1764?
The severity of CVE-2020-1764 is high with a CVSS score of 8.6.
How does CVE-2020-1764 affect Kiali?
CVE-2020-1764 allows a remote attacker to create their own JWT signed tokens and bypass Kiali authentication mechanisms, potentially gaining unauthorized privileges to view and alter data.
Which versions of Kiali are affected by CVE-2020-1764?
All versions of Kiali prior to 1.15.1 are affected by CVE-2020-1764.
How can CVE-2020-1764 be fixed?
To fix CVE-2020-1764, update Kiali to version 1.15.1 or higher.