CVE-2024-6535 Skupper: potential authentication bypass to skupper console via forged cookies

2024-07-1702:25:25

CWE-1392

redhat

github.com

skupper

authentication bypass

forged cookies

cve-2024-6535

openshift oauth-proxy

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

20.9%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-proxy with a static cookie-secret. In certain circumstances, this may allow an attacker to bypass authentication to the Skupper console via a specially-crafted cookie.