CVE-2023-22478 KubePi is vulnerable to missing authorization

What is CVE-2023-22478?

CVE-2023-22478 is a high-severity missing authorization vulnerability in KubeOperator KubePi, published on 14 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.

Weakness: CWE-862

Which versions are affected by CVE-2023-22478?

3 open source packages ship an affected version, including github.com/KubeOperator/kubepi. It affects 1 product.

Products include Fit2cloud Kubepi.

How do I fix CVE-2023-22478?

Upgrade github.com/KubeOperator/kubepi to 1.6.4 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-22478 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-22478 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in KubeOperator KubePi

• CVE-2023-22463 KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token Critical 9.8
• CVE-2023-37917 Privilege Escalation in kubepi Critical 9.1
• CVE-2023-22479 KubePi vulnerable to session fixation attack High 7.5
• CVE-2023-37916 Leak password hash of any user Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gqx8-hxmv-c4v4, GO-2023-1463.