Kuma kuma-cp Default CORS Wildcard + LocalhostIsAdmin Admin Token Leakage

Vulnerability Overview Title: Default kuma-cp configuration leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin Description: The default configuration exposes admin start tokens and signing keys to any web page visited by a user when the control plane is accessible from a browser ( allows all origins) and treats requests from as those of a system administrator. Cross-origin requests ( ) return administrator JWTs and signing materials from a malicious page. Scope Affected Versions: Fixed Versions: Conditions for Affection: 1. is using the default configuration ( and ). 2. The control plane is accessible from a browser on the same machine: - is running on a development laptop. - Docker or ports published on the host. - browsing web pages from the same machine. - An operator accesses a web page hosting attacker JavaScript while the control plane is accessible. Conditions for Non-Affection: The control plane runs in a Kubernetes cluster accessible from remote clients via ClusterIP, NodePort, or LoadBalancer. The control plane runs on an SSH-managed VM with no browser on the host. is set after retrieving the admin token (see https://kuma.io/docs/latest/production/deployment/api-server-authn/). is set to an explicit whitelist excluding attacker origins. Remediation 1. Set after retrieving the admin token. 2. Set to an explicit whitelist, e.g., . 3. Do not run on a machine browsing untrusted sites. Patch Details Fixed Versions: 2.7.25 2.9.15 2.11.13 2.12.10 2.13.5 Changes in Patch Versions: default changed from to — CORS is now optional; if GUI access is required, explicitly set the environment variable. hardening: Now requires both direct loopback and , and rejects requests carrying proxy headers ( ), cross-origin metadata fetches ( ), or non-local host origins. Credits Reporter: @Ludareeno CVSS CVSS: 4.8 / AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SA:N = 5.1 Medium

Goal Reached Thanks to every supporter — we hit 100%!

Kuma kuma-cp Default CORS Wildcard + LocalhostIsAdmin Admin Token Leakage

More from this source