ghsa-55r9-5mx9-qq7r
Vulnerability from github
Published
2024-07-09 21:04
Modified
2024-07-10 18:34
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Summary
Cache driver GetBlob() allows read access to any blob without access control check
Details

Summary

Cache driver GetBlob() allows read access to any blob without access control check

Details

If a Zot accessControl policy allows users read access to some repositories but restricts read access to other repositories and dedupe is enabled (it is enabled by default), then an attacker who knows the name of an image and the digest of a blob (that they do not have read access to), they may maliciously read it via a second repository they do have read access to. This allows an attacker to read an image that the accessControl policy denies.

This attack is possible because ImageStore.CheckBlob() calls checkCacheBlob() to find the blob a global cache by searching for the digest. If it is found, it is copied to the user requested repository with copyBlob().

This cache behavior is intentionally used in RouteHandler.CreateBlobUpload() to implement cross repository blob mount (POST /v2/<name>/blobs/uploads/?mount=<digest>&from=<repository name>) in Zot. This is still missing an access control to check read access on the source repository.

This cache behavior is unexpectedly also used in RouteHandler.CheckBlob() too for HEAD /v2/<name>/blobs/<digest>. If a blob is requested that does not exist on the requested repository, Zot will search for it in a global cache (possibly returning a result from an from an incorrect repository) and then will store it into the ImageStore for the requested repository.

RouteHandler.GetBlob() does not call ImageStore.CheckBlob() so it is not directly vulnerable. However an attacker with only limited read access may first call CheckBlob() to fetch the blob from the cache, then call GetBlob() to read the blob.

Mitigation

The attack may be mitigated by configuring "dedupe": false in the "storage" settings. This disables Zot's cache drivers. dedupe is enabled by default using the BoltDB cache driver.

Impact

An attacker can read images that the accessControl policy denies if they have read access to any other second repository.

This attack only allows accessing blobs (both config and layers) by digest. Manifests cannot be accessed.

This attack requires the attacker to know the name of a private image and its layer digests. A scenario where this might happen is if a project has public CI build logs but publishes the image to a private repository. Many image build tools log layer digests.

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "zotregistry.io/zot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "zotregistry.dev/zot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-39897"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-09T21:04:00Z",
    "nvd_published_at": "2024-07-09T19:15:12Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nCache driver `GetBlob()` allows read access to any blob without access control check\n\n### Details\n\nIf a Zot `accessControl` policy allows users read access to some repositories but restricts read access to other repositories and `dedupe` is enabled (it is enabled by default), then an attacker who knows the name of an image and the digest of a blob (that they do not have read access to), they may maliciously read it via a second repository they do have read access to. This allows an attacker to read an image that the `accessControl` policy denies.\n\nThis attack is possible because [`ImageStore.CheckBlob()` calls `checkCacheBlob()`](https://github.com/project-zot/zot/blob/v2.1.0-rc2/pkg/storage/imagestore/imagestore.go#L1158-L1159) to find the blob a global cache by searching for the digest. If it is found, it is copied to the user requested repository with `copyBlob()`.\n\nThis cache behavior is intentionally used in [`RouteHandler.CreateBlobUpload()`](https://github.com/project-zot/zot/blob/v2.1.0-rc2/pkg/api/routes.go#L1194-L1197) to implement cross repository blob mount (`POST /v2/\u003cname\u003e/blobs/uploads/?mount=\u003cdigest\u003e\u0026from=\u003crepository name\u003e`) in Zot. This is still missing an access control to check read access on the source repository.\n\nThis cache behavior is unexpectedly also used in [`RouteHandler.CheckBlob()`](https://github.com/project-zot/zot/blob/v2.1.0-rc2/pkg/api/routes.go#L886) too for `HEAD /v2/\u003cname\u003e/blobs/\u003cdigest\u003e`. If a blob is requested that does not exist on the requested repository, Zot will search for it in a global cache (possibly returning a result from an from an incorrect repository) and then will store it into the `ImageStore` for the requested repository.\n\n[`RouteHandler.GetBlob()`](https://github.com/project-zot/zot/blob/v2.1.0-rc2/pkg/api/routes.go#L1000) does _not_ call `ImageStore.CheckBlob()` so it is not directly vulnerable. However an attacker with only limited read access may first call `CheckBlob()` to fetch the blob from the cache, then call `GetBlob()` to read the blob.\n\n### Mitigation\n\nThe attack may be mitigated by configuring `\"dedupe\": false` in the `\"storage\"` settings. This disables Zot\u0027s cache drivers. `dedupe` is enabled by default using the BoltDB cache driver.\n\n### Impact\n\nAn attacker can read images that the `accessControl` policy denies if they have read access to any other second repository.\n\nThis attack only allows accessing blobs (both config and layers) by digest. Manifests cannot be accessed.\n\nThis attack requires the attacker to know the name of a private image and its layer digests. A scenario where this might happen is if a project has public CI build logs but publishes the image to a private repository. Many image build tools log layer digests.\n",
  "id": "GHSA-55r9-5mx9-qq7r",
  "modified": "2024-07-10T18:34:34Z",
  "published": "2024-07-09T21:04:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/project-zot/zot/security/advisories/GHSA-55r9-5mx9-qq7r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39897"
    },
    {
      "type": "WEB",
      "url": "https://github.com/project-zot/zot/commit/aaee0220e46bdadd12115ac67c19f9d3153eb1df"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/project-zot/zot"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Cache driver GetBlob() allows read access to any blob without access control check"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.