Description
Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cobbr | Covenant | ≤ 0.6 | — |
References
- GitHub Issue #406 issue-tracking
- https://github.com/cobbr/Covenant product
- https://github.com/cobbr/Covenant/blob/v0.6/Covenant/Hubs/CovenantHub.cs#L28-L33 technical-description
- https://github.com/cobbr/Covenant/blob/v0.6/Covenant/Core/CovenantService.cs#L3958-L3975 technical-description
- VulnCheck Advisory: Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub third-party-advisory