Description
Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
cobbr Covenant
Default version status: unaffected
0 to ≤ 0.6affected
References
- https://github.com/cobbr/Covenant/issues/406 ↗
- https://github.com/cobbr/Covenant ↗
- https://github.com/cobbr/Covenant/blob/v0.6/Covenant/Hubs/CovenantHub.cs#L28-L33 ↗
- https://github.com/cobbr/Covenant/blob/v0.6/Covenant/Core/CovenantService.cs#L3958-L3975 ↗
- https://www.vulncheck.com/advisories/covenant-through-0.6-missing-authentication-on-the-covenanthub-signalr-hub ↗