PT-2024-26898 · Kubepi · Kubepi

Ibranch7 · Published 2024-07-25 · Updated 2024-07-26 · CVE-2024-36111

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions KubePi versions 1.6.3 through 1.7.x

Description The issue is related to a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string is generated to overwrite the key when it is detected to be empty, the key remains empty during actual verification. This allows an attacker to bypass login verification and take over the back end by using an empty key to generate a JWT token.

Recommendations For versions 1.6.3 through 1.7.x, update to version 1.8.0 to resolve the issue. As a temporary workaround, consider disabling the JWT token verification until a patch is available. Restrict access to the KubePi panel to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-1259

Related Identifiers

CVE-2024-36111

GHSA-8Q5R-CVCW-4WX7

Affected Products

Kubepi

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36111.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-36111 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36111 · Vendor Advisory
• https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-8q5r-cvcw-4wx7 · Note
• https://t.me/cvenotify/87532 · Telegram Post
• https://t.me/cvedetector/1632 · Telegram Post