CVE-2020-19003: Verification check bypass in Gate One
Summary
CVE-2020-19003: Verification check bypass in Gate One. Affects gateone versions < 1.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gate One is a package available on PyPI that provides a web-based terminal emulator and SSH client. It allows users to access remote servers through a web browser. Gate One 1.2.0 is affected by a vulnerability that enables attackers to bypass the verification check performed by the origins list. This means that attackers can connect to Gate One instances used by hosts not on the origins list.
Vulnerability Detail
The vulnerability in Gate One 1.2.0 allows attackers to bypass the verification check done by the origins list. This check is intended to restrict access to Gate One instances only to hosts listed in the origins list. By bypassing this check, attackers can connect to Gate One instances used by hosts not on the origins list. The impact of this vulnerability is that unauthorized users can gain access to Gate One instances and potentially perform malicious actions on the connected hosts. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and upgrade to a patched version of Gate One.
Conclusion
Gate One 1.2.0 is affected by a vulnerability that allows attackers to bypass the verification check and connect to Gate One instances used by unauthorized hosts. To mitigate this vulnerability, users should upgrade to a version of Gate One beyond 1.2.0 that includes a patch for this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gateone →
FAQ
Gate One is a web-based terminal emulator and SSH client that allows users to access remote servers through a web browser.
The origins list in Gate One is a configuration setting that specifies the hosts allowed to connect to Gate One instances. It is used to restrict access and ensure only authorized hosts can connect.
The verification check in Gate One compares the host connecting to the Gate One instance with the hosts listed in the origins list. If the connecting host is not in the origins list, the connection is rejected.
The vulnerability allows attackers to bypass the verification check and connect to Gate One instances used by hosts not on the origins list. This can lead to unauthorized access and potential malicious actions on the connected hosts.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
