Kuberoに認証バイパスの脆弱性、JWT鍵未設定の環境が危険
Summary
Kubero 3.0.0から3.1.1に、JWT_SECRETを設定していない環境でログインなしに管理者権限を奪われる脆弱性があります。社内にKuberoがあるか、版とJWT_SECRETの設定状況を確認してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Kubero 3.0.0から3.1.1に、JWT_SECRETを設定していない環境でログインなしに管理者権限を奪われる脆弱性があります。社内にKuberoがあるか、版とJWT_SECRETの設定状況を確認してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| kubero-devkubero |
3.0.0 – 3.1.1→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory vulncheck.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- report github.com
- web github.com
- web github.com