CVE-2024-3622: Mirror-registry: plain-text default csrf secret key
A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same secret key. This flaw allows a malicious actor to craft session cookies and as a consequence, it may lead to gaining access to the affected Quay instance.
Other sources
The default CSRF SECRETKEY in mirror-registry is stored in plain-text on the jinja's config.yaml file, leaving the possibility of every mirror-registry installation which hasn't changed it to have the same SECRETKEY. The CSRF SECRETKEY is used to encrypt the session cookie and the CSRF used to interpret the user sessions. A successful attack may lead to account takeover in the quay instance.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3622?
CVE-2024-3622 is classified as a moderate severity vulnerability due to the potential exposure of sensitive information.
How does CVE-2024-3622 affect Red Hat Quay installations?
CVE-2024-3622 allows all instances of Quay installed using mirror-registry to share the same secret key, compromising individual instance security.
How do I fix CVE-2024-3622?
To mitigate CVE-2024-3622, manually update the configuration to use unique, secure secret keys for each Quay instance.
What causes CVE-2024-3622 vulnerability in Quay?
CVE-2024-3622 is caused by the use of a default secret stored in plain-text format within configuration template files.
Can CVE-2024-3622 be exploited remotely?
Yes, CVE-2024-3622 can be exploited remotely affecting all publicly accessible instances of Quay deployed using the flawed setup.