Arbitrary File Read Vulnerability in ConsoleMe
Summary
CVE-2024-5023: ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command. Affects consoleme versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ConsoleMe is an AWS identity broker that allows users to manage and control access to AWS resources. It provides a self-service flow for templated resources, allowing users to create and manage resources using JSON templates. This vulnerability affects deployments of ConsoleMe that allow templated resources.
Vulnerability Detail
The vulnerability in ConsoleMe allows authenticated users to achieve limited remote code execution (RCE) by exploiting a command injection vulnerability. The self-service flow for templated resources accepts user-supplied JSON post body, including a filename for the templated resource. However, this user-supplied filename is not properly sanitized and is passed directly as a string to a CLI command. By inputting specific flags with a filename value, users can induce an error that reveals the contents of the specified file, potentially leading to unauthorized access to sensitive files on the server.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
pip install --upgrade "consoleme==1.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To mitigate the vulnerability without upgrading or applying code changes, remove the 'cache_resource_templates.repositories' configuration item or set it as an empty array. However, note that this will disable the functionality for templated resources.
Conclusion
The arbitrary file read vulnerability in ConsoleMe allows authenticated users to potentially access sensitive files on the server. It is crucial to upgrade to version v1.4.0 or apply the provided patch to mitigate the vulnerability. Alternatively, removing or modifying the 'cache_resource_templates.repositories' configuration item can also address the issue, but this will disable the functionality for templated resources. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for consoleme →
FAQ
ConsoleMe is an AWS identity broker that allows users to manage and control access to AWS resources.
Deployments of ConsoleMe that allow templated resources are affected. To check if your deployment is impacted, verify the configuration value for 'cache_resource_templates.repositories'. If it does not exist or is an empty array, your deployment is not affected.
Authenticated users can achieve limited remote code execution (RCE) in ConsoleMe, restricted to flag inputs on a single CLI command. However, a specific flag allows users to read any server files accessible by the ConsoleMe process. This could potentially be exploited for privilege escalation if the accessed files contain sensitive information.
Upgrade to version v1.4.0 of ConsoleMe to apply the patch. If upgrading is not possible, selectively apply the code changes from the provided patch. Alternatively, remove the 'cache_resource_templates.repositories' configuration item or set it as an empty array, but note that this will disable the functionality for templated resources.
Yes, a workaround is to remove the 'cache_resource_templates.repositories' configuration item or set it as an empty array. However, this will result in the loss of functionality for templated resources.
References
Related vulnerabilities
Recent vulnerabilities recorded for consoleme.
