Vulnerability · Published Aug 12, 2020 · Assigned by pivotal

CVE-2020-5415Concourse's GitLab auth allows impersonation

Critical 10.0

In plain English

A critical-severity authentication bypass by spoofing in Concourse from VMware Tanzu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)10.0Critical

Exploit odds (30 days)1.2%top 31.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/concourse/concourse	6.3.1	GHSA-627p-rr78-99rj
Go	github.com/concourse/concourse	0.0.0-20200730151558-b00d1c8d8576	GHSA-627p-rr78-99rj
Go	github.com/concourse/concourse	1.6.1-0.20200730151558-b00d1c8d8576	GHSA-627p-rr78-99rj
Go	github.com/concourse/concourse	6.4.1	GHSA-627p-rr78-99rj
Go	github.com/concourse/dex	6.3.1	GHSA-627p-rr78-99rj
Go	github.com/concourse/dex	6.4.1	GHSA-627p-rr78-99rj
Go	github.com/concourse/dex	0.0.0-20200730150203-821b48abfd88	GHSA-627p-rr78-99rj

Affected products (as reported)

Vendor	Product	Versions
VMware Tanzu	Concourse	6.4 – before 6.4.16.3 – before 6.3.1

Weakness: CWE-290 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

References

https://github.com/concourse/concourse/security/advisories/GHSA-627p-rr78-99rj x_refsource_CONFIRM
https://tanzu.vmware.com/security/cve-2020-5415 x_refsource_CONFIRM