CVE-2023-48312 Authentication bypass using an empty token in capsule-proxy

What is CVE-2023-48312?

CVE-2023-48312 is a critical authentication bypass vulnerability in projectcapsule capsule-proxy, published on 24 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a missing check if the user is authenticated based on the `TokenReview` result. All the clusters running with the `anonymous-auth` Kubernetes API Server setting disable (set to `false`) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server. This privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS). This vulnerability has been addressed in version 0.4.6. Users are advised to upgrade.

Weakness: CWE-287

Which versions are affected by CVE-2023-48312?

5 open source packages ship an affected version, including github.com/projectcapsule/capsule-proxy and github.com/clastix/capsule-proxy. It affects 1 product.

Products include Clastix Capsule-Proxy.

How do I fix CVE-2023-48312?

Upgrade github.com/projectcapsule/capsule-proxy to 0.4.6 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-48312 being exploited?

There is no known exploitation of CVE-2023-48312 in the wild and no public exploit code.

Other vulnerabilities in projectcapsule capsule-proxy

• CVE-2022-23652 Privilege escalation using hop-by-hop Connection header High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fpvw-6m5v-hqfp, GO-2023-2351.