{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-36111 exists.","fix":"No fix has been published for CVE-2024-36111 yet. Limit exposure of the affected software until one is available.","what":"CVE-2024-36111 is a medium-severity authentication bypass vulnerability in 1Panel-dev KubePi, published on 25 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-36111 and fix it if it is affected.\n\nWhat it is: CVE-2024-36111 is a medium-severity authentication bypass vulnerability in 1Panel-dev KubePi, published on 25 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-36111 exists.\n\nAffected product: 1Panel-dev KubePi. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-36111/ (Markdown: https://insights.sbomify.com/CVE-2024-36111/index.md)","id":"CVE-2024-36111","markdown":"https://insights.sbomify.com/CVE-2024-36111/index.md","name":"CVE-2024-36111","record":{"aliases":["GHSA-8q5r-cvcw-4wx7"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["account_takeover","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Kubernetes management panel","requires_auth":"low_privilege","summary":"Attackers can bypass login and take over the backend by exploiting a defect where JWT verification uses an empty key despite configuration updates.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-1259","name":"Improper Restriction of Security Token Assignment"}],"description":"KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the key is detected to be empty in the configuration file reading logic, the key is empty during actual verification. Using an empty key to generate a JWT token can bypass the login verification and directly take over the back end. Version 1.8.0 contains a patch for this issue.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"KubePi's JWT token validation has a defect","id":"CVE-2024-36111","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"auth_bypass","year":"2024"},"n_packages":0,"n_references":1,"next":{"headline":"Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects","id":"CVE-2024-36112"},"packages":[],"prev":{"headline":"Cross-site scripting in ansibleguy-webui","id":"CVE-2024-36110"},"products":["KubePi"],"published":"2024-07-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-08-02","vendors":["1Panel-dev"]},"summary":"Attackers can bypass login and take over the backend by exploiting a defect where JWT verification uses an empty key despite configuration updates.","url":"https://insights.sbomify.com/CVE-2024-36111/"}