Red Hat Quay vulnerabilities

A flaw was found in Red Hat Quay where the build trigger management API fails to verify whether a requested trigger belongs to the specified repository.

In Red Hat Quay, a user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit an SSRF vulnerability within the build API by providing a malicious URL, causing the builder to make requests to internal network addresses.

In Red Hat Quay's exported logs feature, an unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. File IDs can be intercepted from plaintext email or webhook callbacks.

In Red Hat Quay's Stripe billing webhook handler, an unauthenticated attacker can forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header.

In Red Hat Quay, when SECURITY_SCANNER_V4_PSK is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint, allowing flooding of the notification queue and injection of path traversal characters into Clair API URL paths.

In Red Hat Quay, an administrator of any repository, by knowing or guessing a target notification's UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. They can also trigger test notifications for another repository.

In Red Hat Quay's external LDAP authentication handling, when an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling user-existence oracle attacks at the referral DN.

In Red Hat Quay's JWT validation for federated robot accounts and SSO authentication, multiple issues related to audience verification and enforcement of azp and sub claims were identified. An attacker with a validly-signed token from the same identity provider could bypass configured security restrictions.

In Red Hat Quay, the Slack and generic webhook notification handlers do not validate URLs against SSRF. A repository administrator can force the Quay worker to send POST requests to internal network addresses or cloud endpoints.

SSRF vulnerability in Red Hat Quay's repository-level mirror configuration. A repository administrator can supply a crafted hostname causing the Quay mirror worker to make requests to internal network services.

A flaw was found in Red Hat Quay where the password re-verification prompt for sensitive operations, such as token generation or robot account creation, can be bypassed. A user with a timed-out session, or an attacker with access to an idle authenticated browser session, can perform privileged actions without providing valid credentials, despite the UI displaying an error for invalid credentials.

In Red Hat Quay, the proxy cache configuration feature does not verify that the specified upstream registry hostname points to a legitimate external service. An organization administrator can supply a crafted hostname, forcing the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.

A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.

A flaw in Red Hat Quay's container image upload process allows an authenticated user with push access to any repository to interfere with other users' in-progress image uploads, including those in repositories they do not have access to. The attacker can read, modify, or cancel another user's image upload.

A Server-Side Request Forgery (SSRF) vulnerability was found in Red Hat Quay and mirror registry for Red Hat OpenShift in the log export feature. An authenticated user can specify an arbitrary callback URL, and a backend process makes server-side HTTP requests to that URL. An attacker could use this to send requests from the application's internal network, potentially leading to disclosure of sensitive information.