ID:3482 - Exploit for Use of Hard-coded Cryptographic Key in Kiali - CVE-2020-1764

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to gain unauthorized access to the system.

The vulnerability exists due to presence of a hard-coded cryptographic key in the default configuration file. A remote attacker can create their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.

Remediation