KubePi is vulnerable to missing authorization

Vulnerability

Overview

KubePi, a modern Kubernetes management panel, contains an authorization bypass vulnerability in its API endpoints. The /v1 route party was configured with middleware (jwt handler and auth handler) only after certain endpoints were already registered, meaning that some API interfaces, including the system logs endpoint, were exposed without proper authentication checks [1][4]. This flaw allows unauthorized entities to interact with these API interfaces and may leak sensitive information about the Kubernetes clusters managed by the panel [1].

Exploitation

The vulnerability exists in the API routing setup. In the commit that fixes the issue, the middleware functions langHandler() and pageHandler() were moved to apply after the session.Install() call, and critically the system.Install() call was moved from the unprotected v1Party to the authenticated authParty party [4]. Any unauthenticated user could directly access the /v1 endpoints that were not covered by the JWT or auth handlers. No special privileges or network position are required beyond the ability to reach the KubePi service [1].

Impact

An attacker who successfully exploits this issue could gain access to sensitive information exposed through the unprotected API endpoints. This includes system logs and potentially other operational data, which could aid further attacks or lead to data disclosure [1][4].

Mitigation

The vulnerability has been patched in KubePi version 1.6.4 [1][2]. There are no known workarounds for affected versions, so upgrading to the latest release is the recommended action [1]. Users should update their installations promptly to prevent potential exploitation.