PT-2025-4847 · Zot+2 · Zot+2
Jeff-Mccoy
·
Published
2025-01-17
·
Updated
2025-01-30
·
CVE-2025-23208
CVSS v3.1
7.3
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
zot versions prior to 2.1.2
Description
The issue arises from the way group data is stored for users in the boltdb database, specifically as an append-list. This leads to group revocations or removals being ignored in the API. When a user logs in, the
SetUserGroups function is called, but instead of replacing the existing group memberships, it appends new ones. This can cause conflicts with group definitions in the config file, although the exact nature of this conflict is not immediately clear. As a result, any Zot configuration relying on group-based authorization will not respect group removal or revocation by an Identity Provider (IdP).Recommendations
For versions prior to 2.1.2, upgrade to version 2.1.2 or later to address the issue.
As a temporary workaround, consider restricting access to the
SetUserGroups function until a patch is available.
Avoid using the UserData variable in the bbolt get meta.db command to prevent appending meaningless duplicate entries.
Restrict access to the boltdb database to minimize the risk of exploitation.Exploit
Fix
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Suse
Boltdb
Zot