PT-2023-18546 · Izanami · Izanami

Raphaël Lob · Published 2023-01-14 · Updated 2023-01-24 · CVE-2023-22495

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Izanami versions prior to 1.11.0

Description The issue allows attackers to bypass authentication in the application when deployed using the official Docker image. This is due to a hard-coded secret used to sign the authentication token (JWT), which could enable an attacker to compromise another instance of the application.

Recommendations For versions prior to 1.11.0, update to version 1.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the JWT authentication mechanism until the update is applied.

Exploit

Fix

Using Hardcoded Credentials

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-798

CWE-288

Related Identifiers

CVE-2023-22495

GHSA-9R7J-M337-792C

Affected Products

Izanami

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22495.json · Exploit
• 🔥 https://github.com/MAIF/izanami/security/advisories/GHSA-9r7j-m337-792c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-22495 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22495 · Vendor Advisory
• https://github.com/MAIF/izanami/releases/tag/v1.11.0 · Note