CVE-2023-45821

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which the `registryIsDockerHub` function was only checking that the registry domain had the `docker.io` suffix. Artifact Hub allows providing some Docker credentials that are used to increase the rate limit applied when interacting with the Docker Hub registry API to read publicly available content. Due to the incorrect check described above, it'd be possible to hijack those credentials by purchasing a domain which ends with `docker.io` and deploying a fake OCI registry on it. <https://artifacthub.io/> uses some credentials that only have permissions to read public content available in the Docker Hub. However, even though credentials for private repositories (disabled on `artifacthub.io`) are handled in a different way, other Artifact Hub deployments could have been using them for a different purpose. This issue has been resolved in version `1.16.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://artifacthub.io/packages/helm/artifact-hub/artifact-hub?modal=changelog&version=1.16.0	Product
https://github.com/artifacthub/hub/security/advisories/GHSA-g6pq-x539-7w4j	Third Party Advisory
https://artifacthub.io/packages/helm/artifact-hub/artifact-hub?modal=changelog&version=1.16.0	Product
https://github.com/artifacthub/hub/security/advisories/GHSA-g6pq-x539-7w4j	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:artifacthub:hub:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:27

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-19 21:15

Updated : 2024-11-21 08:27

NVD link : CVE-2023-45821

Mitre link : CVE-2023-45821

CVE.ORG link : CVE-2023-45821

JSON object : View

Products Affected

artifacthub

hub

CWE

CWE-494

Download of Code Without Integrity Check

NVD-CWE-noinfo

{"id": "CVE-2023-45821", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2023-10-19T21:15:08.847", "references": [{"url": "https://artifacthub.io/packages/helm/artifact-hub/artifact-hub?modal=changelog&version=1.16.0", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/artifacthub/hub/security/advisories/GHSA-g6pq-x539-7w4j", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://artifacthub.io/packages/helm/artifact-hub/artifact-hub?modal=changelog&version=1.16.0", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/artifacthub/hub/security/advisories/GHSA-g6pq-x539-7w4j", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-494"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which the `registryIsDockerHub` function was only checking that the registry domain had the `docker.io` suffix. Artifact Hub allows providing some Docker credentials that are used to increase the rate limit applied when interacting with the Docker Hub registry API to read publicly available content. Due to the incorrect check described above, it'd be possible to hijack those credentials by purchasing a domain which ends with `docker.io` and deploying a fake OCI registry on it. <https://artifacthub.io/> uses some credentials that only have permissions to read public content available in the Docker Hub. However, even though credentials for private repositories (disabled on `artifacthub.io`) are handled in a different way, other Artifact Hub deployments could have been using them for a different purpose. This issue has been resolved in version `1.16.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Artifact Hub es una aplicaci\u00f3n basada en web que permite buscar, instalar y publicar paquetes y configuraciones para proyectos CNCF. Durante una auditor\u00eda de seguridad del c\u00f3digo base de Artifact Hub, un investigador de seguridad identific\u00f3 un error en el que la funci\u00f3n \"registryIsDockerHub\" solo verificaba que el dominio de registro tuviera el sufijo \"docker.io\". Artifact Hub permite proporcionar algunas credenciales de Docker que se utilizan para aumentar el l\u00edmite de velocidad aplicado al interactuar con la API de registro de Docker Hub para leer contenido disponible p\u00fablicamente. Debido a la verificaci\u00f3n incorrecta descrita anteriormente, ser\u00eda posible secuestrar esas credenciales comprando un dominio que termine con `docker.io` e implementando un registro OCI falso en \u00e9l. utiliza algunas credenciales que solo tienen permisos para leer contenido p\u00fablico disponible en Docker Hub. Sin embargo, aunque las credenciales para repositorios privados (deshabilitadas en `artifacthub.io`) se manejan de una manera diferente, otras implementaciones de Artifact Hub podr\u00edan haberlas usado para un prop\u00f3sito diferente. Este problema se resolvi\u00f3 en la versi\u00f3n `1.16.0`. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2024-11-21T08:27:25.503", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:artifacthub:hub:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19535757-82CE-47EA-B827-0273894CF9BD", "versionEndExcluding": "1.16.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}