Description
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| knowns-dev | knowns | < 0.30.0 | 0.30.0 |
References
- GitHub Security Advisory (GHSA-fc85-99vc-9c75) vendor-advisory
- AuthManager.Middleware is a no-op when no password is configured (v0.29.1) technical-description
- Browser listener binds 0.0.0.0 (v0.29.1) technical-description
- POST /api/tunnel/start has no authorization check of its own (v0.29.1) technical-description
- knowns fix commit 878a02cb7cc1 patch
- knowns v0.30.0 Release Notes release-notes
- VulnCheck Advisory: knowns before 0.30.0 Unauthenticated Management API Exposure third-party-advisory