GitHub_MVULNRICHMENT:CVE-2024-36111CVE-2024-36111 KubePi's JWT token validation has a defect
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS
Percentile
9.4%
SSVC
Exploitation
poc
Automatable
no
Technical Impact
partial
KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the key is detected to be empty in the configuration file reading logic, the key is empty during actual verification. Using an empty key to generate a JWT token can bypass the login verification and directly take over the back end. Version 1.8.0 contains a patch for this issue.
CNA Affected
[
{
"vendor": "1Panel-dev",
"product": "KubePi",
"versions": [
{
"status": "affected",
"version": ">= 1.6.3, < 1.8.0"
}
]
}
]ADP Affected
[
{
"cpes": [
"cpe:2.3:a:1panel_dev:kubepi:*:*:*:*:*:*:*:*"
],
"vendor": "1panel_dev",
"product": "kubepi",
"versions": [
{
"status": "affected",
"version": "1.6.3",
"lessThan": "1.8.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS
Percentile
9.4%
SSVC
Exploitation
poc
Automatable
no
Technical Impact
partial