PT-2023-26183 · Kubepi · Kubepi

Ch1Nhpd · Published 2023-07-21 · Updated 2024-08-20 · CVE-2023-37916

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 1.6.5

Description The issue concerns the leakage of password hashes for any user, including administrators, through the /kubepi/api/v1/users/search endpoint. This could allow a motivated attacker to crack the leaked password hashes, potentially leading to unauthorized access. The problem is associated with leaking confidential information and can lead to password cracking attacks.

Recommendations For versions prior to 1.6.5, upgrade to version 1.6.5 to address the issue. As a temporary workaround, consider restricting access to the /kubepi/api/v1/users/search endpoint until the upgrade is possible. Avoid using the pageNum and pageSize parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-37916

GHSA-87F6-8GR7-PC6H

GO-2023-1957

Affected Products

Kubepi

References · 9

• 🔥 https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-87f6-8gr7-pc6h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37916.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-37916 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37916 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-87f6-8gr7-pc6h · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1957 · Vendor Advisory
• https://github.com/1Panel-dev/KubePi · Note
• https://github.com/1Panel-dev/KubePi/releases/tag/v1.6.5 · Note
• https://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview · Note