KubeSphere Security Snafu: Unregistered Users Can Peek at Everything!
KubeSphere’s got a bit of a peek-a-boo problem! The IDOR vulnerability in KubeSphere v3.4.0 & Enterprise v4.1.1 lets unauthorized users access sensitive cluster information. It’s like leaving your front door open and hoping no one notices. Time to patch up and lock down the system before guests overstay their welcome!
Hot Take:
Who needs magic when you have KubeSphere? With this IDOR vulnerability, even a “platform-regular” user can pull rabbits out of hats and data out of clusters! KubeSphere has inadvertently created the ultimate VIP pass for data access – and all without having to join the workspace party. Talk about a guest list oversight!
Key Points:
- IDOR vulnerability found in KubeSphere versions between 3.0.0 & 3.4.1 and 4.0.0 & 4.1.3.
- Exploit allows unauthorized users to access sensitive data.
- Accessible endpoints include cluster overviews, node information, and user accounts.
- Tested on Ubuntu 22.04, with CVE identifier CVE-2024-46528.
- Exploit discovered by Okan Kurtulus.
Already a member? Log in here