PT-2024-13375 · Cubefs · Cubefs
Adamkorcz
·
Published
2024-01-03
·
Updated
2024-06-28
·
CVE-2023-46740
CVSS v4.0
8.2
High
| Vector | AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L |
Name of the Vulnerable Software and Affected Versions
CubeFS versions prior to 3.3.1
Description
CubeFS is an open-source cloud-native file storage system that used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user, thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the
accessKey. To create the accessKey, CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a user's accessKey and impersonate the user to obtain higher privileges. There is no evidence of this vulnerability being exploited in the wild.Recommendations
To resolve the issue, update to version 3.3.1 or later, as there is no other mitigation than to upgrade.
Exploit
Fix
Use of Insufficiently Random Values
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cubefs