CVE-2020-1764: Hard-coded cryptographic key in Kiali
Summary
CVE-2020-1764: Hard coded cryptographic key in Kiali. Affects github.com/kiali/kiali versions < 1.15.1. Fixed in 1.15.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kiali is an open-source project written in Go that provides observability and visualization for Istio service mesh. It allows users to monitor and manage their Istio deployments. Kiali uses JWT signed tokens for authentication. However, prior to version 1.15.1, a hard-coded cryptographic key vulnerability was present in the default configuration file of Kiali. This vulnerability could be exploited by a remote attacker to create their own JWT signed tokens and bypass Kiali's authentication mechanisms. By doing so, the attacker may gain unauthorized privileges to view and alter the Istio configuration.
Vulnerability Detail
The vulnerability in Kiali arises from the presence of a hard-coded cryptographic key in the default configuration file. This key is used for signing JWT tokens, which are employed for authentication. By obtaining knowledge of this key, an attacker can create their own signed tokens and bypass Kiali's authentication mechanisms. This can lead to unauthorized access and potential manipulation of the Istio configuration. The vulnerability has a CVSS score of 8.6, indicating a high severity level.
How To Fix
Minimum fixed version
1.15.1
This is the first release that contains the fix.
go get github.com/kiali/kiali@v1.15.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to the fixed version of Kiali.
Conclusion
In conclusion, the hard-coded cryptographic key vulnerability in Kiali allows remote attackers to bypass authentication mechanisms and potentially gain unauthorized access to the Istio configuration. To mitigate this vulnerability, it is crucial to update Kiali to version 1.15.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/kiali/kiali →
FAQ
Kiali is an open-source project that provides observability and visualization for Istio service mesh deployments. It helps users monitor and manage their Istio deployments.
The vulnerability allows a remote attacker to bypass Kiali's authentication mechanisms and gain unauthorized privileges to view and alter the Istio configuration.
To fix this vulnerability, update Kiali to version 1.15.1 or later.
There is no specific workaround mentioned for this vulnerability. Updating to the fixed version is the recommended solution.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/kiali/kiali.
