Incomplete Fix GHSA-5v7c-xpfp-p65m: Missing OTP Step-up in Cluster Router Allows Node CRUD & Nginx Reload via JWT

Vulnerability Overview Vulnerability Name: Incomplete fix of GHSA-5v7c-xpfp-p65m - the api/cluster router (node CRUD, cluster-wide reload/restart) Vulnerability Description: This vulnerability is an incomplete fix for a previous security patch (GHSA-5v7c-xpfp-p65m). The previous patch added secure session (OTP step-up) requirements to the nginx, cert, dns, backup, site, and stream mutation routers, but did not apply them to the parallel api/cluster router. This results in cluster node management and cluster-wide nginx reload/restart operations being authenticated using only JWT, without OTP step-up. An attacker can exploit a stolen or persisted JWT to perform cluster node CRUD operations (including reading and rewriting node token secrets) and trigger cluster-wide nginx reload/restart. Impact Scope Affected Versions: >= 2.0.0, < 2.5.0 Fixed Version: 2.5.0 CVSS Score: 8.8 / 10 Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High Remediation Recommended Fix: - Wrap the mutation handlers for the cluster router (including node CRUD, nodes/reload_nginx, nodes/restart_nginx, namespace CRUD) with , mirroring the implementation in . - Review other components that may have incomplete fixes, such as the handler, websocket, and upstream socket PUF. POC Code Attack Model and Impact Attacker Model: An authenticated user with a valid JWT but without a fresh secure session. Impact: The attacker can add/edit/delete cluster nodes, read and rewrite node token secrets, and trigger cluster-wide nginx reload/restart. Verification Verification Method: Verified on the HEAD version. The nginx routes are wrapped in , while the cluster routes are registered directly on the group without wrapping, and both are mounted under the group. Tools Tool Usage: Used AI-assisted investigation, but manually verified to confirm its sub-group, to confirm that nodes/namespace/reload/restart registrations lack step-up, and to confirm that both are mounted under the group, thereby source-verified the incomplete fix.

Goal Reached Thanks to every supporter — we hit 100%!

Incomplete Fix GHSA-5v7c-xpfp-p65m: Missing OTP Step-up in Cluster Router Allows Node CRUD & Nginx Reload via JWT

More from this source