Kong Admin <=2.03 - Admin API Access

criticalseverity

9.8CVSS score

33.1%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Kong Admin through 2.0.3 contains an issue via docker-kong which makes the admin API port accessible on interfaces other than 127.0.0.1.

Impact

Remote attackers can gain unauthorized administrative access to the Kong Admin API.

Fix

Upgrade to Kong version 2.0.3 or later to fix the vulnerability and ensure proper authentication and access control mechanisms are in place.

How to confirm it

Send: GET {{BaseURL}} ; GET {{BaseURL}}/admin/
Positive when: contains "Welcome to kong" and "configuration" and "kong_env" AND status 200

Run it with nuclei: nuclei -id CVE-2020-11710 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-11710

info:
  name: Kong Admin <=2.03 - Admin API Access
  author: pikpikcu
  severity: critical
  description: Kong Admin through 2.0.3 contains an issue via docker-kong which makes the admin API port accessible on interfaces other than 127.0.0.1.
  impact: |
    Remote attackers can gain unauthorized administrative access to the Kong Admin API.
  remediation: |
    Upgrade to Kong version 2.0.3 or later to fix the vulnerability and ensure proper authentication and access control mechanisms are in place.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11710
    - https://github.com/Kong/kong
    - https://github.com/Kong/docs.konghq.com/commit/d693827c32144943a2f45abc017c1321b33ff611
    - https://github.com/Kong/docker-kong/commit/dfa095cadf7e8309155be51982d8720daf32e31c
    - https://github.com/Kong/docs.konghq.com/commit/e99cf875d875dd84fdb751079ac37882c9972949
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-11710
    epss-score: 0.33127
    epss-percentile: 0.98377
    cpe: cpe:2.3:a:konghq:docker-kong:*:*:*:*:*:kong:*:*
  metadata:
    max-request: 1
    vendor: konghq
    product: docker-kong
    framework: kong
    shodan-query: cpe:"cpe:2.3:a:konghq:docker-kong"
  tags: cve,cve2020,kong,konghq,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/admin/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Welcome to kong'
          - 'configuration'
          - 'kong_env'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from