PT-2023-18682 · Ckan · Ckan

Published 2023-02-03 · Updated 2023-02-14 · CVE-2023-22746

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions CKAN versions (affected versions not specified)

Description The issue concerns CKAN, an open-source data management system, where a default secret key is used across different instances when creating new containers based on specific Docker images. This allows for easy forgery of authentication requests if users do not set a custom secret key via environment variables in the .env file. The affected images include ckan/ckan-docker, ckan/ckan-base, okfn/docker-ckan, openknowledge/ckan-base, openknowledge/ckan-dev, keitaroinc/docker-ckan, and keitaro/ckan images.

Recommendations For all affected versions, set a custom secret key via environment variables in the .env file to prevent the use of the default shared secret key. As a temporary workaround, consider overriding the default secret key in your own .env file until a more permanent solution is implemented. Restrict access to authentication endpoints to minimize the risk of exploitation.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-344

CWE-330

Related Identifiers

CVE-2023-22746

GHSA-PR8J-V4C8-H62X

Affected Products

Ckan

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22746.json · Exploit
• https://github.com/ckan/ckan/commit/4c22c135fa486afa13855d1cdb9765eaf418d2aa · Patch
• https://github.com/ckan/ckan/commit/44af0f0a148fcc0e0fbcf02fe69b7db13459a84b · Patch
• https://osv.dev/vulnerability/CVE-2023-22746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22746 · Security Note
• https://github.com/ckan/ckan/security/advisories/GHSA-pr8j-v4c8-h62x · Note