CVE-2023-22479 KubePi vulnerable to session fixation attack

What is CVE-2023-22479?

CVE-2023-22479 is a high-severity authentication bypass vulnerability in KubeOperator KubePi, published on 10 Jan 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4.

Weakness: CWE-384

Which versions are affected by CVE-2023-22479?

3 open source packages ship an affected version, including github.com/KubeOperator/kubepi. It affects 1 product.

Products include Fit2cloud Kubepi.

How do I fix CVE-2023-22479?

Upgrade github.com/KubeOperator/kubepi to 1.6.4 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-22479 being exploited?

There is no known exploitation of CVE-2023-22479 in the wild and no public exploit code.

Other vulnerabilities in KubeOperator KubePi

• CVE-2023-22463 KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token Critical 9.8
• CVE-2023-37917 Privilege Escalation in kubepi Critical 9.1
• CVE-2023-22478 KubePi is vulnerable to missing authorization High 7.3
• CVE-2023-37916 Leak password hash of any user Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v4w5-r2xc-7f8h, GO-2023-1468.