Vulnerability · Published Sep 26, 2022 · Assigned by GitHub_M
CVE-2022-39219Bifrost users using basic authntication can bypass write permission limit
High 8.5
In plain English
A high-severity improper authentication in Bifrost from brokercap. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests when they are normally forbidden from doing so. Version 1.8.7-release contains a patch. There are currently no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/brokercap/Bifrost | 1.8.7-release | GHSA-p6fh-xc6r-g5hw |
| Go | github.com/brokercap/Bifrost | 1.8.7-release | GO-2022-1023 |
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
References
- https://github.com/brokercap/Bifrost/security/advisories/GHSA-p6fh-xc6r-g5hw x_refsource_CONFIRM
- https://github.com/brokercap/Bifrost/issues/200 x_refsource_MISC
- https://github.com/brokercap/Bifrost/releases/tag/v1.8.7-release x_refsource_MISC