CVE-2023-22480 (Go)

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.

Weakness:
CWE-285: name: Improper Authorization
description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-863: name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-250: name: Execution with Unnecessary Privileges
description: The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
CWE-269: name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Repository: https://github.com/KubeOperator/KubeOperator

Vulnerable code:
file_path: pkg/router/v1/v1api.go
snippet: func V1(parent iris.Party) {
	v1 := parent.Party("/v1")
	authParty := v1.Party("/auth")
	mvc.New(authParty.Party("/session")).HandleError(ErrorHandler).Handle(controller.NewSessionController())
	mvc.New(v1.Party("/user")).HandleError(ErrorHandler).Handle(controller.NewForgotPasswordController())
	AuthScope = v1.Party("/")
	AuthScope.Use(middleware.JWTMiddleware().Serve)
	AuthScope.Use(middleware.UserMiddleware)
	AuthScope.Use(middleware.RBACMiddleware())
	AuthScope.Use(middleware.PagerMiddleware)
	AuthScope.Use(middleware.ForceMiddleware)
	mvc.New(AuthScope.Party("/clusters")).HandleError(ErrorHandler).Handle(controller.NewClusterController())
	mvc.New(AuthScope.Party("/credentials")).HandleError(ErrorHandler).Handle(controller.NewCredentialController())
	mvc.New(AuthScope.Party("/hosts")).HandleError(ErrorHandler).Handle(controller.NewHostController())
	mvc.New(AuthScope.Party("/users")).HandleError(ErrorHandler).Handle(controller.NewUserController())
	mvc.New(AuthScope.Party("/dashboard")).HandleError(ErrorHandler).Handle(controller.NewKubePiController())
	mvc.New(AuthScope.Party("/regions")).HandleError(ErrorHandler).Handle(controller.NewRegionController())
	mvc.New(AuthScope.Party("/zones")).HandleError(ErrorHandler).Handle(controller.NewZoneController())
	mvc.New(AuthScope.Party("/plans")).HandleError(ErrorHandler).Handle(controller.NewPlanController())
	mvc.New(AuthScope.Party("/settings")).HandleError(ErrorHandler).Handle(controller.NewSystemSettingController())
	mvc.New(AuthScope.Party("/ntp")).HandleError(ErrorHandler).Handle(controller.NewNtpServerController())
	mvc.New(AuthScope.Party("/logs")).HandleError(ErrorHandler).Handle(controller.NewSystemLogController())
	mvc.New(AuthScope.Party("/projects")).HandleError(ErrorHandler).Handle(controller.NewProjectController())
	mvc.New(AuthScope.Party("/clusters/provisioner")).HandleError(ErrorHandler).Handle(controller.NewProvisionerController())
	mvc.New(AuthScope.Party("/kubernetes")).HandleError(ErrorHandler).Handle(controller.NewKubernetesController())
	mvc.New(AuthScope.Party("/clusters/tool")).HandleError(ErrorHandler).Handle(controller.NewClusterToolController())
	mvc.New(AuthScope.Party("/backupaccounts")).HandleError(ErrorHandler).Handle(controller.NewBackupAccountController())
	mvc.New(AuthScope.Party("/clusters/backup")).HandleError(ErrorHandler).Handle(controller.NewClusterBackupStrategyController())
	mvc.New(AuthScope.Party("/clusters/monitor")).HandleError(ErrorHandler).Handle(controller.NewMonitorController())
	mvc.New(AuthScope.Party("/tasks")).Handle(ErrorHandler).Handle(controller.NewTaskLogController())
	mvc.New(AuthScope.Party("/components")).Handle(ErrorHandler).Handle(controller.NewComponentController())
	mvc.New(AuthScope.Party("/license")).Handle(ErrorHandler).Handle(controller.NewLicenseController())
	mvc.New(AuthScope.Party("/clusters/backup/files")).HandleError(ErrorHandler).Handle(controller.NewClusterBackupFileController())
	mvc.New(AuthScope.Party("/clusters/velero/{cluster}/{operate}")).HandleError(ErrorHandler).Handle(controller.NewClusterVeleroBackupController())
	mvc.New(AuthScope.Party("/manifests")).HandleError(ErrorHandler).Handle(controller.NewManifestController())
	mvc.New(AuthScope.Party("/vmconfigs")).HandleError(ErrorHandler).Handle(controller.NewVmConfigController())
	mvc.New(AuthScope.Party("/ippools")).HandleError(ErrorHandler).Handle(controller.NewIpPoolController())
	mvc.New(AuthScope.Party("/ippools/{name}/ips")).HandleError(ErrorHandler).Handle(controller.NewIpController())
	mvc.New(AuthScope.Party("/projects/{project}/resources")).HandleError(ErrorHandler).Handle(controller.NewProjectResourceController())
	mvc.New(AuthScope.Party("/projects/{project}/members")).HandleError(ErrorHandler).Handle(controller.NewProjectMemberController())
	mvc.New(AuthScope.Party("/projects/{project}/clusters/{cluster}/members")).HandleError(ErrorHandler).Handle(controller.NewClusterMemberController())
	mvc.New(AuthScope.Party("/projects/{project}/clusters/{cluster}/resources")).HandleError(ErrorHandler).Handle(controller.NewClusterResourceController())
	mvc.New(AuthScope.Party("/templates")).HandleError(ErrorHandler).Handle(controller.NewTemplateConfigController())
	mvc.New(AuthScope.Party("/clusters/grade")).HandleError(ErrorHandler).Handle(controller.NewGradeController())
	mvc.New(AuthScope.Party("/ldap")).HandleError(ErrorHandler).Handle(controller.NewLdapController())
	mvc.New(AuthScope.Party("/msg/accounts")).HandleError(ErrorHandler).Handle(controller.NewMessageAccountController())
	mvc.New(AuthScope.Party("/msg/subscribes")).HandleError(ErrorHandler).Handle(controller.NewMessageSubscribeController())
	mvc.New(AuthScope.Party("/user/messages")).HandleError(ErrorHandler).Handle(controller.NewUserMsgController())
	mvc.New(AuthScope.Party("/user/settings")).HandleError(ErrorHandler).Handle(controller.NewUserSettingController())
	WhiteScope = v1.Party("/")
	WhiteScope.Get("/clusters/kubeconfig/{name}", downloadKubeconfig)
	WhiteScope.Get("/captcha", generateCaptcha)
	mvc.New(WhiteScope.Party("/theme")).HandleError(ErrorHandler).Handle(controller.NewThemeController())

}

Fixed code:
file_path: pkg/router/v1/v1api.go
snippet: func V1(parent iris.Party) {
	v1 := parent.Party("/v1")
	authParty := v1.Party("/auth")
	mvc.New(authParty.Party("/session")).HandleError(ErrorHandler).Handle(controller.NewSessionController())
	mvc.New(v1.Party("/user")).HandleError(ErrorHandler).Handle(controller.NewForgotPasswordController())
	AuthScope = v1.Party("/")
	AuthScope.Use(middleware.JWTMiddleware().Serve)
	AuthScope.Use(middleware.UserMiddleware)
	AuthScope.Use(middleware.RBACMiddleware())
	AuthScope.Use(middleware.PagerMiddleware)
	AuthScope.Use(middleware.ForceMiddleware)
	mvc.New(AuthScope.Party("/clusters")).HandleError(ErrorHandler).Handle(controller.NewClusterController())
	mvc.New(AuthScope.Party("/credentials")).HandleError(ErrorHandler).Handle(controller.NewCredentialController())
	mvc.New(AuthScope.Party("/hosts")).HandleError(ErrorHandler).Handle(controller.NewHostController())
	mvc.New(AuthScope.Party("/users")).HandleError(ErrorHandler).Handle(controller.NewUserController())
	mvc.New(AuthScope.Party("/dashboard")).HandleError(ErrorHandler).Handle(controller.NewKubePiController())
	mvc.New(AuthScope.Party("/regions")).HandleError(ErrorHandler).Handle(controller.NewRegionController())
	mvc.New(AuthScope.Party("/zones")).HandleError(ErrorHandler).Handle(controller.NewZoneController())
	mvc.New(AuthScope.Party("/plans")).HandleError(ErrorHandler).Handle(controller.NewPlanController())
	mvc.New(AuthScope.Party("/settings")).HandleError(ErrorHandler).Handle(controller.NewSystemSettingController())
	mvc.New(AuthScope.Party("/ntp")).HandleError(ErrorHandler).Handle(controller.NewNtpServerController())
	mvc.New(AuthScope.Party("/logs")).HandleError(ErrorHandler).Handle(controller.NewSystemLogController())
	mvc.New(AuthScope.Party("/projects")).HandleError(ErrorHandler).Handle(controller.NewProjectController())
	mvc.New(AuthScope.Party("/clusters/provisioner")).HandleError(ErrorHandler).Handle(controller.NewProvisionerController())
	mvc.New(AuthScope.Party("/kubernetes")).HandleError(ErrorHandler).Handle(controller.NewKubernetesController())
	mvc.New(AuthScope.Party("/clusters/tool")).HandleError(ErrorHandler).Handle(controller.NewClusterToolController())
	mvc.New(AuthScope.Party("/backupaccounts")).HandleError(ErrorHandler).Handle(controller.NewBackupAccountController())
	mvc.New(AuthScope.Party("/clusters/backup")).HandleError(ErrorHandler).Handle(controller.NewClusterBackupStrategyController())
	mvc.New(AuthScope.Party("/clusters/monitor")).HandleError(ErrorHandler).Handle(controller.NewMonitorController())
	mvc.New(AuthScope.Party("/tasks")).Handle(ErrorHandler).Handle(controller.NewTaskLogController())
	mvc.New(AuthScope.Party("/components")).Handle(ErrorHandler).Handle(controller.NewComponentController())
	mvc.New(AuthScope.Party("/license")).Handle(ErrorHandler).Handle(controller.NewLicenseController())
	mvc.New(AuthScope.Party("/clusters/backup/files")).HandleError(ErrorHandler).Handle(controller.NewClusterBackupFileController())
	mvc.New(AuthScope.Party("/clusters/velero/{cluster}/{operate}")).HandleError(ErrorHandler).Handle(controller.NewClusterVeleroBackupController())
	mvc.New(AuthScope.Party("/manifests")).HandleError(ErrorHandler).Handle(controller.NewManifestController())
	mvc.New(AuthScope.Party("/vmconfigs")).HandleError(ErrorHandler).Handle(controller.NewVmConfigController())
	mvc.New(AuthScope.Party("/ippools")).HandleError(ErrorHandler).Handle(controller.NewIpPoolController())
	mvc.New(AuthScope.Party("/ippools/{name}/ips")).HandleError(ErrorHandler).Handle(controller.NewIpController())
	mvc.New(AuthScope.Party("/projects/{project}/resources")).HandleError(ErrorHandler).Handle(controller.NewProjectResourceController())
	mvc.New(AuthScope.Party("/projects/{project}/members")).HandleError(ErrorHandler).Handle(controller.NewProjectMemberController())
	mvc.New(AuthScope.Party("/projects/{project}/clusters/{cluster}/members")).HandleError(ErrorHandler).Handle(controller.NewClusterMemberController())
	mvc.New(AuthScope.Party("/projects/{project}/clusters/{cluster}/resources")).HandleError(ErrorHandler).Handle(controller.NewClusterResourceController())
	mvc.New(AuthScope.Party("/templates")).HandleError(ErrorHandler).Handle(controller.NewTemplateConfigController())
	mvc.New(AuthScope.Party("/clusters/grade")).HandleError(ErrorHandler).Handle(controller.NewGradeController())
	mvc.New(AuthScope.Party("/ldap")).HandleError(ErrorHandler).Handle(controller.NewLdapController())
	mvc.New(AuthScope.Party("/msg/accounts")).HandleError(ErrorHandler).Handle(controller.NewMessageAccountController())
	mvc.New(AuthScope.Party("/msg/subscribes")).HandleError(ErrorHandler).Handle(controller.NewMessageSubscribeController())
	mvc.New(AuthScope.Party("/user/messages")).HandleError(ErrorHandler).Handle(controller.NewUserMsgController())
	mvc.New(AuthScope.Party("/user/settings")).HandleError(ErrorHandler).Handle(controller.NewUserSettingController())
	AuthScope.Get("/clusters/kubeconfig/{name}", downloadKubeconfig)
	WhiteScope = v1.Party("/")
	WhiteScope.Get("/captcha", generateCaptcha)
	mvc.New(WhiteScope.Party("/theme")).HandleError(ErrorHandler).Handle(controller.NewThemeController())

}