CVE-2023-46740 Insecure random string generator used for sensitive data
Attackers can predict user access keys due to insecure random generation, allowing them to impersonate users and gain higher privileges in CubeFS deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46740?
CVE-2023-46740 is a medium-severity vulnerability in cubefs, published on 3 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the “accessKey”. To create the "accesKey", CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.
Weakness: CWE-330
Which versions are affected by CVE-2023-46740?
3 open source packages ship an affected version, including github.com/cubefs/cubefs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cubefs/cubefs Go | All versions | None |
github.com/cubefs/cubefs Go | All versions | 3.3.1 |
github.com/cubefs/cubefs Go | All versions | 3.3.1 |
Products include Linuxfoundation Cubefs.
How do I fix CVE-2023-46740?
Upgrade github.com/cubefs/cubefs to 3.3.1 or later.
Is CVE-2023-46740 being exploited?
There is no known exploitation of CVE-2023-46740 in the wild and no public exploit code.
Other vulnerabilities in cubefs
- CVE-2023-46738 Authenticated users can crash the CubeFS servers with maliciously crafted requests
- CVE-2023-46739 Timing attack can leak user passwords
- CVE-2023-30512 CubeFS allows Kubernetes cluster-level privilege escalation
- CVE-2023-46741 CubeFS leaks magic secret key when starting Blobstore access service
- CVE-2023-46742 CubeFS leaks users key in logs
Sources
Also known as GHSA-4248-p65p-hcrm, GO-2024-2431.