CVE-2024-7631: Openshift-console: openshift console: path traversal
A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.
Other sources
Path traversal is a vulnerability that allows an attacker to read arbitrary files and directories that are stored outside of the intended files to distribute. This might include sensitive files like secrets, configuration files as well as sensitive operating system files (like /etc/passwd). The OpenShift Console has an endpoint for plugins to serve resources in multiple languages: /locales/resources.json The lng and ns parameters for this endpoint are used to unsafely construct a filepath in pkg/plugins/handlers.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.
Impact: Because of the affected endpoint's logic, only files with the .json extension can be accessed, limiting greatly the impact of this vulnerability. No security-impactful JSON files could be identified on the console's pod.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7631?
CVE-2024-7631 is rated as a high-severity vulnerability due to its potential impact on OpenShift Console users.
How do I fix CVE-2024-7631?
To mitigate CVE-2024-7631, ensure you are using a patched version of Red Hat OpenShift Console above 6.0.6.
Which versions of OpenShift Console are affected by CVE-2024-7631?
CVE-2024-7631 affects Red Hat OpenShift Console versions up to and including 6.0.6.
What components are impacted by CVE-2024-7631?
The vulnerability affects the OpenShift Console's handling of the /locales/resources.json endpoint.
Is CVE-2024-7631 exploitable remotely?
Yes, CVE-2024-7631 can be exploited remotely if the OpenShift Console is exposed to the internet.