Core security flaw in version ≤ 1.0.1

[davidep (Davide Principi)]

A security flaw was found in NS8 Beta 1. The issue remediation is already available in Core update 1.1.0.

Further issue details will be disclosed on next Monday, Jun 26.

[davidep (Davide Principi)]

To fix the flaw, follow the update procedure documented here

Core update 1.1.0

This is the first update to NS8 core since Beta 1 release announcement. This brief recap is written by hand because our @nethbot is still not trained for NS8! Security alert First of all, this update contains an important security fix. It will be fully disclosed next Monday. In the mean time, follow the instructions below. New features Custom certificate upload #413 #407 #33 Thanks to @Tbaile Bugfixes Clean up JWT token validation with gin-jwt #414 H…

Read that post carefully and run also the commands as described there!

[davidep (Davide Principi)]

Description

The api-server component returns a valid JWT string to user default with any password. Obtaining such token is possible to anyone by simply reaching the HTTPS address /cluster-admin.

An attacker could potentially steal the system administrator password or other secrets exchanged by the system administrator by invoking the administrative APIs of the cluster-admin web application.

Parameters of API invocations (like a password change request) are retained for 8 hours: during this time frame they are accessible with a valid JWT.

Solution

Just follow the instructions of Core update 1.1.0 ⚠, then do not forget to change the password of the cluster-admin application.