A flaw was found in the OpenShift console where several endpoints use the authHandler() and authHandlerWithUser() middleware functions. When the default authentication provider (‘openShiftAuth’) is set, these functions do not perform authentication checks, leading to various degrees of data exposure due to inadequate credential verification.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2024-7128 |
Exploitation
To exploit this vulnerability, an attacker could leverage the lack of authentication checks in the OpenShift console endpoints. By targeting these endpoints, the attacker may gain unauthorized access to sensitive data or perform actions without proper authorization, depending on the service’s reliance on the targeted authentication.
Affected Products
- OpenShift Console: The console’s endpoints are vulnerable due to improper authentication checks.
Mitigation
To mitigate this vulnerability, it is recommended to review and update the authentication configurations in the OpenShift console. Ensure that proper authentication checks are implemented for all endpoints, especially when using the default authentication provider.