knowns before 0.30.0 Unauthenticated Management API Exposure
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.4%
exploitation probability
0.4%top 62% of all CVEs
observed exploitation
nono source reports it
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
knowns-dev · knownsReferences
https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/cli/browser.go#L193-L200https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/auth.go#L80-L86https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/routes/tunnel.go#L26-L38https://github.com/knowns-dev/knowns/commit/878a02cb7cc14f0a592fdfda7a520af3cac500fbhttps://github.com/knowns-dev/knowns/releases/tag/v0.30.0https://github.com/knowns-dev/knowns/security/advisories/GHSA-fc85-99vc-9c75https://www.vulncheck.com/advisories/knowns-before-0.30.0-unauthenticated-management-api-exposure