PT-2023-29712 · Unknown · Artifact Hub

Dejanzelic · Published 2023-10-19 · Updated 2026-05-06 · CVE-2023-45823

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Artifact Hub versions prior to 1.16.0

Description Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. A security researcher identified a bug in which by using symbolic links in certain kinds of repositories loaded into Artifact Hub, it was possible to read internal files. Artifact Hub indexes content from a variety of sources, including git repositories. When processing git based repositories, Artifact Hub clones the repository and, depending on the artifact kind, reads some files from it. During this process, in some cases, no validation was done to check if the file was a symbolic link. This made possible to read arbitrary files in the system, potentially leaking sensitive information.

Recommendations For versions prior to 1.16.0, upgrade to version 1.16.0 to resolve the issue. As a temporary workaround, consider restricting access to the git repositories processed by Artifact Hub to minimize the risk of exploitation. Avoid using symbolic links in repositories loaded into Artifact Hub until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-45823

GHSA-HMQ4-C2R4-5Q8H

GO-2023-2136

Affected Products

Artifact Hub

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45823.json · Exploit
• https://osv.dev/vulnerability/GHSA-hmq4-c2r4-5q8h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45823 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45823 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2136 · Vendor Advisory
• https://github.com/artifacthub/hub/security/advisories/GHSA-hmq4-c2r4-5q8h · Note
• https://github.com/artifacthub/hub · Note
• https://twitter.com/dailycve/status/2051831091246268657 · Twitter Post
• https://artifacthub.io/packages/helm/artifact-hub/artifact-hub?modal=changelog&version=1.16.0 · Note
• https://t.me/cibsecurity/72634 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1715135876324262201 · Twitter Post
• https://t.me/cvenotify/60200 · Telegram Post
• https://twitter.com/CVEnew/status/1715113947626647983 · Twitter Post