Kiali Authentication Bypass vulnerability in github.com/kiali/kiali
Summary
CVE-2021-20278: Kiali Authentication Bypass vulnerability in github.com/kiali/kiali. Affects github.com/kiali/kiali versions < 1.31.0. Fixed in 1.31.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kiali is an open-source project written in Go that provides observability and visualization for the Istio service mesh. It offers various features such as monitoring, tracing, and logging for microservices running on the Istio platform. However, a vulnerability has been discovered in the authentication mechanism of Kiali, which could allow unauthorized access to sensitive information and functionality.
Vulnerability Detail
The Kiali Authentication Bypass vulnerability in github.com/kiali/kiali allows an attacker to bypass the authentication mechanism and gain unauthorized access to the Kiali dashboard. This vulnerability can be exploited by sending specially crafted requests to the affected application. Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information, modification of configurations, and potential disruption of the Istio service mesh.
How To Fix
Minimum fixed version
1.31.0
This is the first release that contains the fix.
go get github.com/kiali/kiali@v1.31.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version of the Kiali package as soon as possible.
Conclusion
The Kiali Authentication Bypass vulnerability in github.com/kiali/kiali poses a significant security risk to applications utilizing the Kiali package. It is crucial to upgrade to the fixed version of the package to mitigate the risk of unauthorized access and potential disruption of the Istio service mesh.
See every vulnerability recorded for github.com/kiali/kiali →
FAQ
Kiali is an open-source project that provides observability and visualization for the Istio service mesh.
This vulnerability allows unauthorized access to the Kiali dashboard, potentially leading to unauthorized access to sensitive information and disruption of the Istio service mesh.
To fix this vulnerability, upgrade to version 1.31.0 or later of the Kiali package.
There are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the vulnerability report at the following URL: https://pkg.go.dev/vuln/GO-2022-0700
Related vulnerabilities
Recent vulnerabilities recorded for github.com/kiali/kiali.
