CVE-2022-36089: kubevela Authentication Bypass by Capture-replay

Vulnerability summary

CVE-2022-36089 is a critical (CVSS 9.8) Authentication Bypass by Capture-replay vulnerability in kubevela. EPSS estimates a 0.87% chance of exploitation in the next 30 days, higher than 58.4% of scored vulnerabilities.

Timeline

1. 07-09-2022
   PublishedVulnerability first disclosed.
2. 23-04-2025
   Last modifiedVulnerability information updated.

Description

KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the `PlatformID` as the signed key to generate the JWT tokens for users. Another API called `getSystemInfo` exposes the platformID. This vulnerability allows users to use the platformID to re-generate the JWT tokens to bypass the authentication. Versions 1.4.11 and 1.5.4 contain a patch for this issue.

• CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).