CVE-2020-1762: Insufficient Session Expiration in Kiali
Summary
CVE-2020-1762: Insufficient Session Expiration in Kiali in github.com/kiali/kiali. Affects github.com/kiali/kiali versions >= 0.4.0, < 1.15.1. Fixed in 1.15.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kiali is an open-source project written in Go that provides observability and visualization for the Istio service mesh. It offers a web-based user interface to monitor and manage the components of the service mesh. The vulnerability in Kiali allows for insufficient session expiration, which can lead to unauthorized access and potential security breaches.
Vulnerability Detail
The vulnerability in Kiali arises from the improper handling of session expiration. When a user session is not properly terminated or expired, an attacker could potentially gain unauthorized access to the Kiali interface. This can result in the exposure of sensitive information, unauthorized configuration changes, or other malicious activities. The vulnerability affects versions 0.4.0 to 1.15.1 of the Kiali package.
How To Fix
Minimum fixed version
1.15.1
This is the first release that contains the fix.
go get github.com/kiali/kiali@v1.15.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually terminate their sessions after each use by logging out of the Kiali interface. This ensures that the session is properly expired and reduces the risk of unauthorized access. Here is an example of how to manually terminate a session using the Kiali API:
POST /api/logout
This API call will invalidate the current session and log the user out of Kiali.
Conclusion
The vulnerability in Kiali that allows for insufficient session expiration poses a risk of unauthorized access and potential security breaches. It is crucial for users to update their Kiali installation to the latest version (1.15.1 or higher) to mitigate this vulnerability. Additionally, manually terminating sessions after each use can serve as a temporary workaround.
See every vulnerability recorded for github.com/kiali/kiali →
FAQ
The vulnerability allows for unauthorized access to the Kiali interface, which can lead to the exposure of sensitive information and potential security breaches.
Versions 0.4.0 to 1.15.1 of the Kiali package are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your Kiali installation is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, updating to version 1.15.1 or higher of the Kiali package will fix this vulnerability.
As a workaround, users can manually terminate their sessions after each use by logging out of the Kiali interface.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/kiali/kiali.
