CVE-2020-5415 Concourse's GitLab auth allows impersonation
Attackers can impersonate authorized users by matching their full name in GitLab, bypassing access controls in Concourse CI installations using GitLab auth.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-5415?
CVE-2020-5415 is a critical authentication bypass vulnerability in VMware Tanzu Concourse, published on 12 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.
Weakness: CWE-290
Which versions are affected by CVE-2020-5415?
15 open source packages ship an affected version, including github.com/concourse/concourse, concourse and github.com/concourse/dex. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/concourse/concourse Go | All versions | 0.0.0-20200730151558-b00d1c8d8576 |
github.com/concourse/concourse Go | All versions | 0.0.0-20200730151558-b00d1c8d8576 |
github.com/concourse/concourse Go | From 0.0.0 | 1.6.1-0.20200730151558-b00d1c8d8576 |
github.com/concourse/concourse Go | From 0.0.0 | 1.6.1-0.20200730151558-b00d1c8d8576 |
github.com/concourse/concourse Go | From 1.6.1 | 6.3.1 |
github.com/concourse/concourse Go | From 1.6.1 | 6.3.1 |
9 more packages
github.com/concourse/concourse Go | From 6.4.0 | 6.4.1 |
github.com/concourse/concourse Go | From 6.4.0 | 6.4.1 |
concourse Bitnami | All versions | 6.3.1, 6.4.1 |
github.com/concourse/dex Go | All versions | 0.0.0-20200730150203-821b48abfd88 |
github.com/concourse/dex Go | All versions | 0.0.0-20200730150203-821b48abfd88 |
github.com/concourse/dex Go | From 0.0.0 | 6.3.1 |
github.com/concourse/dex Go | From 0.0.0 | 6.3.1 |
github.com/concourse/dex Go | From 6.4.0 | 6.4.1 |
github.com/concourse/dex Go | From 6.4.0 | 6.4.1 |
Products include Pivotal Software Concourse.
How do I fix CVE-2020-5415?
Upgrade github.com/concourse/concourse to a fixed version for your release line: 0.0.0-20200730151558-b00d1c8d8576, 1.6.1-0.20200730151558-b00d1c8d8576, 6.3.1 or 6.4.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-5415 being exploited?
There is no known exploitation of CVE-2020-5415 in the wild and no public exploit code.
Other vulnerabilities in VMware Tanzu Concourse
- CVE-2020-5409 Concourse Open Redirect in the /sky/login endpoint
- CVE-2018-15798 Pivotal Concourse allows malicious redirect urls on login
- CVE-2018-1227 Supply chain in Concourse CI: As of 2018-03-13, Pivotal does not believe that any resources or builds of Concourse have been compromised.
- CVE-2019-3792 Concourse 5.0.0 SQL Injection vulnerability
- CVE-2022-31683 Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution
Sources
Also known as BIT-concourse-2020-5415, GHSA-627p-rr78-99rj.