CVE-2024-6535 Skupper: potential authentication bypass to skupper console via forged cookies
Attackers can bypass authentication to the Skupper console by forging cookies when configured with OpenShift OAuth proxy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-6535?
CVE-2024-6535 is a medium-severity authentication bypass vulnerability in Red Hat Service Interconnect 1, published on 17 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-proxy with a static cookie-secret. In certain circumstances, this may allow an attacker to bypass authentication to the Skupper console via a specially-crafted cookie.
Which versions are affected by CVE-2024-6535?
3 open source packages ship an affected version, including github.com/skupperproject/skupper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/skupperproject/skupper Go | All versions | 0.0.0-20240703184342-c26bce4079ff |
github.com/skupperproject/skupper Go | All versions | 0.0.0-20240703184342-c26bce4079ff |
github.com/skupperproject/skupper Go | All versions | 0.0.0-20240703184342-c26bce4079ff |
Products include Redhat Service Interconnect.
How do I fix CVE-2024-6535?
Upgrade github.com/skupperproject/skupper to 0.0.0-20240703184342-c26bce4079ff or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-6535 being exploited?
There is no known exploitation of CVE-2024-6535 in the wild and no public exploit code.
Other vulnerabilities in Red Hat Service Interconnect 1
Sources
Also known as GHSA-w799-v85j-88pg, GO-2024-2987.