CVE-2022-31683: Authorization Bypass in Concourse
Summary
CVE-2022-31683: Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. Affects concourse across 2 version ranges.
>= 6.0.0, < 6.7.9
>= 7.0.0, < 7.8.3
Fixed in 6.7.9 or 7.8.3, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-31683 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concourse is an open-source continuous integration and delivery (CI/CD) platform developed by Pivotal Software. It provides a scalable and flexible solution for automating software builds, tests, and deployments. Concourse allows teams to define pipelines that consist of tasks and resources, enabling efficient collaboration and streamlined software delivery. However, versions 6.x.y prior to 6.7.9 and 7.x.y prior to 7.8.3 of Concourse are susceptible to an authorization bypass vulnerability.
Vulnerability Detail
The vulnerability in Concourse (CVE-2022-31683) allows a user to bypass team scope checks and gain unauthorized access to resources belonging to other teams. By sending a request with the body parameter 'team_name=team2', an attacker can exploit this flaw and access certain resources that should be restricted to a specific team. This vulnerability poses a risk to the confidentiality and integrity of sensitive data and can potentially lead to unauthorized actions within the CI/CD pipeline.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.7.96.7.9 -
>= 7.0.0, < 7.8.37.8.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading Concourse to the fixed versions mentioned above.
Conclusion
The authorization bypass vulnerability in Concourse (CVE-2022-31683) allows unauthorized access to resources belonging to other teams. To mitigate this vulnerability, it is crucial to upgrade Concourse to version 6.7.9 or later (for version 6.x.y) or version 7.8.3 or later (for version 7.x.y). For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for concourse →
FAQ
This vulnerability allows an attacker to bypass team scope checks in Concourse and gain unauthorized access to resources belonging to other teams. It can lead to unauthorized actions and potential data breaches within the CI/CD pipeline.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Concourse installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
No, only versions 6.x.y prior to 6.7.9 and 7.x.y prior to 7.8.3 of Concourse are vulnerable to this authorization bypass issue. It is recommended to upgrade to the fixed versions to mitigate the vulnerability.
No, there is no known workaround for this vulnerability. Upgrading to the fixed versions is the recommended solution.
You can find more information about this vulnerability in the Concourse vulnerability database entry: [link to the vulnerability database entry].
References
Related vulnerabilities
Recent vulnerabilities recorded for concourse.
