CVE-2020-1764 PoC — Kiali 信任管理问题漏洞

Source

https://github.com/jpts/cve-2020-1764-poc

Associated Vulnerability

Title:Kiali 信任管理问题漏洞 (CVE-2020-1764)
Description:Kiali是一款开源的、用于Istio微服务架构的可视化管理工具。 Kiali 1.15.1之前版本中的默认配置文件存在安全漏洞，该漏洞源于该文件带有硬编码的加密密钥。远程攻击者可利用该漏洞绕过身份验证机制，获取权限来查看并修改Istio配置。

Description

Auth Bypass PoC for Kiali

Readme

# CVE-2020-1764 PoC

Auth bypass PoC for Kiali 0.4.0 to 1.15.0 using login auth strategy ([Security Bulletin](https://istio.io/latest/news/security/istio-security-2020-004/))

check version: `curl 'http://<IP>/api`

check auth strategy: `curl 'http://<IP>/api/auth/info'`

`go run ./poc.go`

`curl 'http://<IP>/api/status' -H "Authorization: Bearer $JWT"`

File Snapshot


 [4.0K]  /data/pocs/3dcf4c9a485f2d322bc17d23e447648e9ee2d6fc
├── [ 424]  poc.go
└── [ 356]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!