PT-2022-23178 · Kubevela · Kubevela

Fogdong · Published 2022-09-07 · Updated 2022-09-16 · CVE-2022-36089

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions KubeVela versions prior to 1.4.11 and 1.5.4

Description KubeVela is an application delivery platform that could be affected by an authentication bypass issue. The VelaUX APIServer uses the PlatformID as the signed key to generate JWT tokens for users. The getSystemInfo API exposes the platformID, allowing users to re-generate JWT tokens and bypass authentication.

Recommendations For versions prior to 1.4.11, update to version 1.4.11 or later. For versions prior to 1.5.4, update to version 1.5.4 or later. As a temporary workaround, consider restricting access to the getSystemInfo API to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2022-36089

GHSA-CQ42-W295-R29Q

Affected Products

Kubevela

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36089.json · Exploit
• https://github.com/kubevela/kubevela/security/advisories/GHSA-cq42-w295-r29q · Patch
• https://osv.dev/vulnerability/CVE-2022-36089 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36089 · Security Note
• https://github.com/kubevela/kubevela/pull/4634 · Note
• https://t.me/cibsecurity/49414 · Telegram Post