CVE-2022-31055 Improper Access Control in kctf
Attackers can bypass IP restrictions to access private CTF challenges due to broken source IP filtering in kctf.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-31055?
CVE-2022-31055 is a high-severity missing authorization vulnerability in google kctf, published on 13 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
kCTF is a Kubernetes-based infrastructure for capture the flag (CTF) competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1.6.0. As a workaround, those who want to test challenges privately can mark them as `public: false` and use `kctf chal debug port-forward` to connect.
Weakness: CWE-284
Which versions are affected by CVE-2022-31055?
It affects 1 product.
Products include Google Kctf.
How do I fix CVE-2022-31055?
No fix has been published for CVE-2022-31055 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-31055 being exploited?
There is no known exploitation of CVE-2022-31055 in the wild and no public exploit code.
Sources
Also known as GHSA-4g2v-6qc6-6jv5.