Security Bulletins on Kiali

KIALI-SECURITY-003 - Installation into ad-hoc namespaces

Tue, 11 May 2021 11:00:00 -0600

Description

Disclosure date: May 11, 2021
Affected Releases: prior to 1.33.0
Impact Score: 6.6 - AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

A vulnerability was found in the Kiali Operator allowing installation of a specified image into any namespace.

Kiali users are exposed to this vulnerability if all the following conditions are met:

Kiali operator is used for installation.
Kiali CR was edited to install an image into an unapproved namespace.

This vulnerability is filed as CVE-2021-3495

Mitigation

If you can update:

KIALI-SECURITY-002 - Authentication bypass when using the OpenID login strategy

Thu, 04 Mar 2021 11:00:00 -0600

Description

Disclosure date: March 5, 2021
Affected Releases: 1.26.0, 1.26.1, 1.26.2, 1.27.0, 1.28.0, 1.28.1, 1.29.0, 1.29.1, 1.30.0
Impact Score: 7.0 - AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:X/RC:C

A vulnerability was found in Kiali allowing an attacker to bypass the authentication mechanism. The vulnerability lets an attacker build forged credentials and use them to gain unauthorized access to Kiali.

Kiali users are exposed to this vulnerability if all the following conditions are met:

Kiali is setup with the openid authentication strategy.
As a result of configurations in both Kiali and your OpenID server, Kiali uses the implicit flow of the OpenID specification to negotiate authentication.
Kiali is setup with RBAC turned off.

This vulnerability is filed as CVE-2021-20278

KIALI-SECURITY-001 - Authentication bypass using forged credentials

Tue, 24 Mar 2020 11:00:00 -0600

Description

Disclosure date: March 25, 2020
Affected Releases: 0.4.0 to 1.15.0
Impact Score: 9.4 - AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

A vulnerability was found in Kiali allowing an attacker to bypass the authentication mechanism. Currently, Kiali has four authentication mechanisms: login, token, openshift and ldap. All are vulnerable.

The vulnerability lets an attacker build forged credentials and use them to gain unauthorized access to Kiali.

Additionally, it was found that Kiali credentials were not being validated properly. Depending on the authentication mechanism configured in Kiali, this could facilitate unauthorized access into Kiali with forged and/or invalid credentials.