Vulnerability · Published Jul 9, 2024 · Assigned by GitHub_M
CVE-2024-39897Cache driver GetBlob() allows read access to any blob without access control check
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in zot from project-zot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
zot is an OCI image registry. Prior to 2.1.0, the cache driver `GetBlob()` allows read access to any blob without access control check. If a Zot `accessControl` policy allows users read access to some repositories but restricts read access to other repositories and `dedupe` is enabled (it is enabled by default), then an attacker who knows the name of an image and the digest of a blob (that they do not have read access to), they may maliciously read it via a second repository they do have read access to. This attack is possible because [`ImageStore.CheckBlob()` calls `checkCacheBlob()`](https://github.com/project-zot/zot/blob/v2.1.0-rc2/pkg/storage/imagestore/imagestore.go#L1158-L1159) to find the blob a global cache by searching for the digest. If it is found, it is copied to the user requested repository with `copyBlob()`. The attack may be mitigated by configuring "dedupe": false in the "storage" settings. The vulnerability is fixed in 2.1.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | zotregistry.dev/zot | 2.1.0 | GHSA-55r9-5mx9-qq7r |
| Go | zotregistry.dev/zot | no fix listed | GO-2024-2979 |
| Go | zotregistry.io/zot | 2.1.0 | GHSA-55r9-5mx9-qq7r |
| Go | zotregistry.io/zot | no fix listed | GO-2024-2979 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| project-zot | zot | < 2.1.0 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N