Bug 2238908 (CVE-2023-4959) - CVE-2023-4959 quay: Cross-Site Request Forgery (CSRF) on config-editor page
Summary: CVE-2023-4959 quay: Cross-Site Request Forgery (CSRF) on config-editor page
Keywords:
Status: NEW
Alias: CVE-2023-4959
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2237319
TreeView+ depends on / blocked
 
Reported: 2023-09-14 09:14 UTC by Avinash Hanwate
Modified: 2023-09-15 09:00 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: ---
Doc Text:
A flaw was found in Quay. Cross-site request forgery (CSRF) attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the victim’s browser into sending an attacker-controlled request from another domain, it is possible to reconfigure the Quay instance (including adding users with admin privileges).
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description Avinash Hanwate 2023-09-14 09:14:11 UTC
Cross-Site Request Forgery or CSRF attacks force a user to perform unwanted actions in an application. Through the use of techniques such as social engineering (e.g. sending a link via email), or existing vulnerabilities in the domain itself or others (e.g. XSS), the attacker gets users of the web application to silently execute actions in the context of the user's session. The consequences of exploiting this vulnerability range from compromising the data or operations of a user, to the compromise of the entire web application, if the user has the role of "Administrator".
During the pentest, it has been detected that the config-editor page (https://example-registry-quay-config-editor-openshift-operators.apps.automagic.gcp.quaydev.org/) is vulnerable to CSRF. The config-editor page is used to configure the Quay instance.


Note You need to log in before you can comment on or make changes to this bug.