Critical OS Command Injection Vulnerability Discovered in Kestra OSS

What changed

The Kestra OSS platform, known for its event-driven orchestration capabilities, has revealed a significant security flaw. The vulnerability arises from the AuthenticationFilter's method of whitelisting the public configuration endpoint, which allows unauthenticated users to bypass authentication.

This flaw, present in versions prior to 1.0.45 and 1.3.21, permits attackers to exploit the system by leveraging any API path that ends with 'configs', thereby gaining unauthorized access to create and execute workflows.

Who is affected

The vulnerability impacts various users and organizations utilizing Kestra OSS for orchestration tasks. The following groups are particularly at risk:

Organizations that rely on Kestra OSS for managing workflows and automation processes may find themselves exposed to potential exploitation.

• Kestra OSS users prior to versions 1.0.45 and 1.3.21
• Developers utilizing Kestra for event-driven orchestration
• Organizations integrating Kestra with other applications or services

What to do

To mitigate the risks associated with this vulnerability, immediate action is recommended. Users should update their Kestra OSS installations to the latest versions to ensure protection against potential attacks.

Additionally, organizations should review their security policies and access controls to further safeguard their systems.

• Upgrade to Kestra OSS version 1.0.45 or 1.3.21 or later
• Implement strict access controls on API endpoints
• Regularly audit and monitor system configurations for vulnerabilities