GHSA-757p-vx43-fp9r
KubePi Privilege Escalation vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/KubeOperator/kubepi | < 1.6.5 | 1.6.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request
### PoC
Change the value of the `isadmin` field in the request to true:
https://drive.google.com/file/d/1e8XJbIFIDXaFiL-dqn0a0b6u7o3CwqSG/preview
### Impact
Elevate user privileges
References
External links from the advisory. They lead to third-party sites.