-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/karmada-io/dashboard | go | < 0.2.0 | 0.2.0 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability, GHSA-5qjg-9mjh-4r92, is an authentication bypass in the Karmada Dashboard API. My analysis of the provided patches confirms that the root cause was the complete absence of an authentication and authorization enforcement mechanism for the API endpoints under the /api/v1 path.
The primary fix was introduced in commit 1b3672eff4994dbe61cbb7cccaabd665a2d33ec5, which created a new AuthMiddleware. This middleware, applied in cmd/api/app/router/setup.go, ensures that every request to a v1 API endpoint has a valid Authorization token. Before this change, any function handling a route under /api/v1 was effectively public.
Furthermore, the handler functions themselves were using privileged in-cluster clients (e.g., client.InClusterKarmadaClient()) to interact with the Kubernetes and Karmada APIs. This meant that an unauthenticated request would be processed with the full permissions of the Karmada Dashboard's service account. The patches in commit a7defcd475486122eca5cfe18110b423a3c53851 refactored all API handlers to retrieve the API client from the request context, which is populated by the new ClientMiddleware using the credentials from the authenticated user's request. This ensures that even authenticated users can only perform actions they are authorized to.
The vulnerability description explicitly mentions endpoints like /api/v1/secret and /api/v1/service, which are handled by functions like handleGetSecrets and handleGetServices. These, along with numerous other handlers for different resource types (deployments, jobs, policies, etc.), were all vulnerable due to the missing middleware. Any of these function names would appear in a runtime profile during exploitation. The generateAPIProxy function was also patched to enforce authentication for proxied requests.
In summary, the identified vulnerable functions are the API handlers that, prior to the patch, were processing unauthenticated requests using privileged clients. The evidence is the widespread replacement of privileged client creation with context-aware client retrieval, enabled by the new authentication middleware.
handleGetSecretscmd/api/app/routes/secret/handler.go
handleGetServicescmd/api/app/routes/service/handler.go
handleGetClusterListcmd/api/app/routes/cluster/handler.go
generateAPIProxycmd/web/app/web.go
AuthMiddlewarecmd/api/app/router/middleware.go
Ongoing coverage of React2Shell