CVE-2023-22463: KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token
First published: Wed Jan 04 2023(Updated: )
KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermore, they may use the administrator to take over the k8s cluster of the target enterprise. `session.go`, the use of hard-coded JwtSigKey, allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. The vulnerability has been fixed in 1.6.3. In the patch, JWT key is specified in app.yml. If the user leaves it blank, a random key will be used. There are no workarounds aside from upgrading.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fit2cloud Kubepi | <1.6.3 | |
| <1.6.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/KubeOperator/KubePi/blob/da784f5532ea2495b92708cacb32703bff3a45a3/internal/api/v1/session/session.go#L35
- https://github.com/KubeOperator/KubePi/commit/3be58b8df5bc05d2343c30371dd5fcf6a9fbbf8b
- https://github.com/KubeOperator/KubePi/releases/tag/v1.6.3
- https://github.com/KubeOperator/KubePi/security/advisories/GHSA-vjhf-8vqx-vqpq
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-22463.
What is the severity of CVE-2023-22463?
CVE-2023-22463 has a severity keyword of 'critical' and a severity value of 9.8.
What is the affected software for CVE-2023-22463?
The affected software for CVE-2023-22463 is Fit2cloud Kubepi with versions up to but not including 1.6.3.
How does CVE-2023-22463 affect the jwt authentication function of KubePi?
CVE-2023-22463 affects the jwt authentication function of KubePi by using hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects.
How can an attacker exploit CVE-2023-22463?
An attacker can exploit CVE-2023-22463 by forging any jwt token to take over the administrator account of any online project.
- collector/nvd-index
- agent/references
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/fit2cloud
- canonical/fit2cloud kubepi