PT-2023-18546 · Izanami · Izanami

Raphaël Lob · Publicado 2023-01-14 · Atualizado 2023-01-24 · CVE-2023-22495

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Izanami versions prior to 1.11.0

Description The issue allows attackers to bypass authentication in the application when deployed using the official Docker image. This is due to a hard-coded secret used to sign the authentication token (JWT), which could enable an attacker to compromise another instance of the application.

Recommendations For versions prior to 1.11.0, update to version 1.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the JWT authentication mechanism until the update is applied.

Exploit

Correção

Using Hardcoded Credentials

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-798

CWE-288

Identificadores relacionados

CVE-2023-22495

GHSA-9R7J-M337-792C

Produtos afetados

Izanami

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22495.json · Exploit
• 🔥 https://github.com/MAIF/izanami/security/advisories/GHSA-9r7j-m337-792c · Exploit
• https://github.com/MAIF/izanami/releases/tag/v1.11.0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-22495 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-22495 · Aviso do Fabricante