PT-2022-20888 · Concourse · Concourse

Rui42 · Published 2022-10-19 · Updated 2024-03-06 · CVE-2022-31683

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concourse versions 6.x.y prior to 6.7.9 Concourse versions 7.x.y prior to 7.8.3

Description The issue is an authorization bypass that allows a Concourse user to send a request with a body including :team name=team2 to bypass team scope checks and gain access to certain resources belonging to any other team. This can be done by exploiting specific API endpoints, such as "/api/v1/teams/:team name/pipelines/:pipeline name/jobs/:job name/builds/:build name" with a POST method, or "/api/v1/teams/:team name/pipelines/:pipeline name/jobs/:job name/pause" with a PUT method. The user only needs a valid user session and to belong to team2.

Recommendations For Concourse versions 6.x.y prior to 6.7.9, update to version 6.7.9 to resolve the issue. For Concourse versions 7.x.y prior to 7.8.3, update to version 7.8.3 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints, such as "/api/v1/teams/:team name/pipelines/:pipeline name/jobs/:job name/builds/:build name" and "/api/v1/teams/:team name/pipelines/:pipeline name/jobs/:job name/pause", until a patch is applied.

Exploit

Fix

Incorrect Authorization

IDOR

Weakness Enumeration

CWE-863

CWE-639

Related Identifiers

BIT-CONCOURSE-2022-31683

CVE-2022-31683

GHSA-5JP2-VWRJ-99RF

Affected Products

Concourse

References · 14

• 🔥 https://github.com/concourse/concourse/security/advisories/GHSA-5jp2-vwrj-99rf · Exploit
• https://osv.dev/vulnerability/CVE-2022-31683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31683 · Security Note
• https://osv.dev/vulnerability/BIT-concourse-2022-31683 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5jp2-vwrj-99rf · Vendor Advisory
• https://github.com/concourse/concourse/releases/tag/v6.7.9 · Note
• https://github.com/concourse/concourse · Note
• https://github.com/concourse/concourse/commit/ba885834d9bcbb9d1ccb9964faa7af0e78a72205 · Note
• https://github.com/concourse/concourse/pull/8580 · Note
• https://github.com/concourse/concourse/releases/tag/v7.8.3 · Note
• https://github.com/concourse/concourse/pull/8566 · Note
• https://github.com/concourse/concourse/commit/57e06711b0d861775a5a6bd078a34abeb0e2638e · Note
• https://t.me/cvenotify/40199 · Telegram Post
• https://t.me/cibsecurity/54885 · Telegram Post