migration-planner Package Vulnerability: Broken Access Control
- Severity
- HIGH
- Affected component
- github.com/kubev2v/migration-planner (go)
- Affected versions
- < 0.13.5
- Patched version
- Not yet available
An improper access control vulnerability in the migration-planner package could allow an authenticated attacker to obtain presigned S3 URLs for other users' OVA images.
What happened
An early warning has been issued regarding a vulnerability in the migration-planner package. The vulnerability, tracked as GHSA-V5M8-5455-QW2X, involves improper access control in the /api/v1/sources/{id}/image-url endpoint. This flaw allows an authenticated attacker to bypass ownership checks and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. This could potentially lead to unauthorized access and modification of the victim's source.
The affected component is github.com/kubev2v/migration-planner (go) for versions less than 0.13.5. The vulnerability has not been reported as exploited in the wild. Users of this package should assess their exposure based on their current version and the provided details.
What to do about it
- Monitor for updates from the maintainers of the migration-planner package.
- Apply patches as they become available.
- Ensure that your version of the migration-planner package is 0.13.5 or later.
- Review access controls and authentication mechanisms in your deployment of the migration-planner package.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
github.com/kubev2v/migration-planner is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using github.com/kubev2v/migration-planner (go) version less than 0.13.5.
What should I do right now?
Monitor for updates from the maintainers and apply patches as they become available. Ensure your version is 0.13.5 or later.
Has this been exploited in the wild?
The vulnerability has not been reported as exploited in the wild.