Summary http://kube.pi/kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password of any user (including admin). This leads to password crack attack
PoC https://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview
Impact - Leaking confidential information. - Can lead to password cracking attacks
Summary A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request
PoC Change the value of the isadmin field in the request to true: https://drive.google.com/file/d/1e8XJbIFIDXaFiL-dqn0a0b6u7o3CwqSG/preview
Impact Elevate user privileges
Summary A session fixation attack allows an attacker to hijack a legitimate user session. The attack investigates a flaw in how the online application handles the session ID, especially the susceptible web application.
Affected Version <= v1.6.3
Patches The vulnerability has been fixed in v1.6.4.
https://github.com/KubeOperator/KubePi/commit/1e9c550356c1a425a742480efcf743d373e98dcb : A session fixation attack allows an attacker to hijack a legitimate user session.
Workarounds It is recommended to upgrade the version to v1.6.4.
For more information If you have any questions or comments about this advisory, please open an issue.
This vulnerability is reported by sachinh09 from huntr.dev.
Summary Unauthorized access refers to the ability to bypass the system's preset permission settings to access some API interfaces. The attack exploits a flaw in how online applications handle routing permissions.
Affected Version <= v1.6.3
Patches The vulnerability has been fixed in v1.6.4.
https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6
Workarounds It is recommended to upgrade the version to v1.6.4.
For more information If you have any questions or comments about this advisory, please open an issue.
References https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4
KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermore, they may use the administrator to take over the k8s cluster of the target enterprise. session.go, the use of hard-coded JwtSigKey, allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. The vulnerability has been fixed in 1.6.3. In the patch, JWT key is specified in app.yml. If the user leaves it blank, a random key will be used. There are no workarounds aside from upgrading.