Vulnerability in Skupper Console Exposes Sensitive Data and Impacts Resource Availability

Summary

A significant flaw exists in the Skupper Console, which serves as a read-only interface presenting network traffic details and metrics for applications configured in hybrid multi-cloud environments. The vulnerability arises when the default authentication mechanism is employed, resulting in the generation of a random password for the 'admin' user. This password is stored in plaintext within a Kubernetes secret or a Podman volume, leaving it susceptible to interception. An attacker exploiting this method can read any user-readable file within the container's filesystem, directly jeopardizing data confidentiality. Furthermore, by manipulating Skupper’s behavior, an attacker can prompt the system to read excessively large files into memory, potentially leading to a denial-of-service condition due to resource exhaustion.

References