Authentication Bypass in Kubero via Hardcoded JWT Secret

Executive Summary

Kubero versions 3.0.0 through 3.1.1 have an authentication bypass flaw due to a hardcoded fallback JWT secret. When the JWT_SECRET environment variable is unset, the system uses a default secret to sign tokens. Attackers can forge administrative JWTs with arbitrary roles, permissions, and user groups, which the system trusts without database validation. This allows full control over pipelines, applications, users, and API tokens.

Useful 0 Not Useful 0

Detection Guidance

Check if the JWT_SECRET environment variable is unset in Kubero deployments. Inspect the jwt.strategy.ts file for hardcoded fallback secrets. Look for unauthenticated requests with JWT tokens containing arbitrary role, userGroups, or permissions claims.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to sensitive functions like user management, pipeline control, and application configurations. They could create valid tokens with elevated privileges, bypass authentication, and manipulate data or deployments. This could lead to data breaches, service disruption, or complete system takeover if JWT_SECRET is unset.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR's integrity and confidentiality principles or HIPAA's access controls. Unauthorized access risks exposing sensitive data, leading to potential legal penalties, loss of trust, and failure to meet regulatory standards for authentication and authorization.

Useful 0 Not Useful 0

Mitigation Strategies

Set a strong, unique JWT_SECRET environment variable in all Kubero deployments. Remove any hardcoded fallback secrets from the jwt.strategy.ts file. Rotate all existing JWT tokens and API tokens to prevent misuse.

Useful 0 Not Useful 0