CVE-2021-42192
📋 TL;DR
CVE-2021-42192 is an incorrect access control vulnerability in Konga v0.14.9 that allows authenticated users to escalate privileges to admin level through specially crafted requests. This affects all Konga installations running the vulnerable version. Attackers can gain full administrative control over the Kong API gateway management interface.
💻 Affected Systems
- Konga
📦 What is this software?
Konga by Konga Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Kong API gateway management, allowing attackers to reconfigure API routes, expose sensitive data, disrupt services, and potentially pivot to backend systems.
Likely Case
Unauthorized administrative access leading to API gateway configuration changes, service disruption, and potential data exposure.
If Mitigated
Limited impact if proper network segmentation, authentication controls, and monitoring are in place to detect unusual administrative activity.
🎯 Exploit Status
Exploit requires authenticated user access but is trivial to execute once authenticated. Public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.14.10 and later
Vendor Advisory: https://github.com/pantsel/konga/commit/d61535277aced18b5be0313ab2d124f60f649978
Restart Required: Yes
Instructions:
1. Backup current Konga configuration and data. 2. Update Konga to version 0.14.10 or later. 3. Restart Konga service. 4. Verify the fix by checking version and testing privilege escalation attempts.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to Konga interface to only trusted IP addresses or VPN users.
Use firewall rules (e.g., iptables, AWS Security Groups, Azure NSG) to limit access
Enhanced Authentication
allImplement additional authentication layers like IP whitelisting, VPN access, or multi-factor authentication.
Configure Konga behind reverse proxy with additional auth (e.g., nginx auth_basic, OAuth proxy)
🧯 If You Can't Patch
- Implement strict network segmentation and limit Konga access to only necessary administrative users
- Enable detailed logging and monitoring for privilege escalation attempts and unusual administrative activities
🔍 How to Verify
Check if Vulnerable:
Check Konga version via web interface or by examining the running container/process. Version 0.14.9 or earlier is vulnerable.Check Version:
Check Konga web interface footer or API endpoint, or run: docker inspect konga_container | grep -i versionVerify Fix Applied:
After updating, verify version is 0.14.10 or later. Test with authenticated non-admin user attempting privilege escalation - should fail.📡 Detection & Monitoring
Log Indicators:
- Unusual user privilege changes
- Multiple failed admin access attempts from non-admin users
- User role modification logs showing escalation
Network Indicators:
- HTTP POST requests to user/role modification endpoints from non-admin accounts
- Unusual API calls to administrative endpoints
SIEM Query:
source="konga" AND (event="user_role_change" OR event="privilege_escalation" OR status="403" AND path="/api/user/*")🔗 References
- https://docs.google.com/document/d/1-YU9zWiDVUps3Mb6zos3996yvZ48vW_vfOvaJLLHc4I/edit?usp=sharing
- https://github.com/pantsel/konga/
- https://github.com/pantsel/konga/commit/d61535277aced18b5be0313ab2d124f60f649978
- https://github.com/whokilleddb/Konga-Privilege-Escalation-Exploit
- https://www.exploit-db.com/exploits/50521
- https://docs.google.com/document/d/1-YU9zWiDVUps3Mb6zos3996yvZ48vW_vfOvaJLLHc4I/edit?usp=sharing
- https://github.com/pantsel/konga/
- https://github.com/pantsel/konga/commit/d61535277aced18b5be0313ab2d124f60f649978
- https://github.com/whokilleddb/Konga-Privilege-Escalation-Exploit
- https://www.exploit-db.com/exploits/50521
