CVE-2024-12582: Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service
A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the "admin" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack.
Other sources
When a skupper site is initialized with the console enabled and the default authentication method selected, it configures the skupper console with a flawed basic auth implementation. This implementation can be manipulated by an actor with network access to bypass authentication or to DOS the skupper console - potentially impacting the functionality of the skupper installation.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not enable the skupper console during skupper site initialization. Initialize the site with the console disabled to avoid configuring the flawed default basic-auth implementation.
skupper console console enabled = false - Configuration
When configuring or initializing the skupper console, avoid selecting the default basic authentication method. Choose and configure an alternative, stronger authentication method instead of the default basic auth.
skupper console authentication method = do not use default/basic auth - Compensating control
Restrict network access to the skupper console endpoints (for example via firewall rules, network ACLs, or Kubernetes NetworkPolicies) to trusted IPs or internal networks to prevent unauthenticated access or DoS by external actors.
- Operational
Locate the randomly generated 'admin' password persisted in the Kubernetes secret or the podman volume plaintext file, rotate the admin password, and remove the plaintext file from the podman volume and/or update or remove the plaintext secret so credentials are not stored in plaintext.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12582?
CVE-2024-12582 has been assessed to have a medium severity due to potential unauthorized access to sensitive metrics.
How do I fix CVE-2024-12582?
To mitigate CVE-2024-12582, ensure secure authentication methods are implemented instead of the default random password.
Which software is affected by CVE-2024-12582?
CVE-2024-12582 affects the Skupper console and Skupper CLI components.
What are the potential impacts of CVE-2024-12582?
The potential impacts of CVE-2024-12582 include exposure of sensitive cluster network and traffic details.
Is there a workaround for CVE-2024-12582?
A workaround for CVE-2024-12582 is to disable the default authentication method and implement a more secure login process.