PT-2022-24861 · Unknown · Flyteadmin

Enghabu · Published 2022-10-05 · Updated 2022-12-09 · CVE-2022-39273

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FlyteAdmin versions prior to 1.1.44

Description The default authorization server's configuration settings contain a known hardcoded hashed password. Users who enable authentication without changing the default clientid hashes will be exposed to the public internet. Attackers can effectively impersonate propeller by using this default password, allowing public traffic in. This issue only applies to users who have not specified the ExternalAuthorizationServer setting. Using an external auth server automatically turns off this default configuration and protects against this issue.

Recommendations For versions prior to 1.1.44, users should manually set the staticClients in the selfAuthServer section of their configuration if they intend to rely on Admin’s internal auth server. As a temporary workaround, consider disabling the default authorization server until a patch is available. Restrict access to the default Flyte Propeller configmap to minimize the risk of exploitation. Avoid using the default clientid hashes in the authorization server configuration until the issue is resolved.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-39273

GHSA-67X4-QR35-QVRM

GO-2022-1043

Affected Products

Flyteadmin

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39273.json · Exploit
• https://github.com/flyteorg/flyteadmin/pull/478 · Patch
• https://osv.dev/vulnerability/GO-2022-1043 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39273 · Security Note
• https://docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html#oauth2-authorization-server · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-67x4-qr35-qvrm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39273 · Vendor Advisory
• https://github.com/flyteorg/flyteadmin · Note
• https://github.com/flyteorg/flyteadmin/commit/281172edf55fe6800959238fc128964ead6d9101 · Note
• https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-67x4-qr35-qvrm · Note
• https://t.me/cibsecurity/50909 · Telegram Post
• https://pkg.go.dev/vuln/GO-2022-1043 · Note
• https://github.com/advisories/GHSA-67x4-qr35-qvrm · Note