PT-2022-16907 · Garden · Garden

Published 2022-04-11 · Updated 2022-04-19 · CVE-2022-24829

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Garden versions prior to 0.12.39

Description Garden is an automation platform for Kubernetes development and testing. In some operating modes, multiple endpoints did not require authentication, allowing an attacker to gain access to the application erroneously. The configuration is leaked through the "/api" endpoint on the local server responsible for serving the Garden dashboard. This server is accessible to anyone on the same network, or anyone on the internet if they are on a public, static IP, which may lead to the ability to compromise credentials, secrets, or environment variables.

Recommendations For versions prior to 0.12.39, upgrade to version 0.12.39 as soon as possible. For users unable to upgrade, use a firewall to block access to port 9777 from all untrusted network machines.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-24829

GHSA-F5F3-QRQW-2VQF

Affected Products

Garden

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24829.json · Exploit
• https://github.com/garden-io/garden/commit/56051a5b50409227bc420910da88ed156a6e432b · Patch
• https://osv.dev/vulnerability/CVE-2022-24829 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24829 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24829 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24829 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-24829 · Security Note
• https://github.com/garden-io/garden/security/advisories/GHSA-f5f3-qrqw-2vqf · Note
• https://t.me/cibsecurity/40546 · Telegram Post