CVE-2023-36106
📋 TL;DR
An incorrect access control vulnerability in PowerJob versions 4.3.2 and earlier allows remote attackers to obtain sensitive information by querying the /container/list interface with an appId parameter. This affects PowerJob users running vulnerable versions, potentially exposing container information and other sensitive data.
💻 Affected Systems
- PowerJob
📦 What is this software?
Powerjob by Powerjob
⚠️ Risk & Real-World Impact
Worst Case
Attackers could enumerate all container information across applications, potentially accessing sensitive configuration data, secrets, or proprietary application logic.
Likely Case
Unauthorized access to container metadata and configuration information, potentially revealing application structure and deployment details.
If Mitigated
With proper access controls and network segmentation, impact is limited to information disclosure within authorized network segments.
🎯 Exploit Status
Simple HTTP request manipulation required. Public proof-of-concept demonstrates exploitation via appId parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.3 or later
Vendor Advisory: https://gitee.com/KFCFans/PowerJob
Restart Required: Yes
Instructions:
1. Upgrade PowerJob to version 4.3.3 or later. 2. Restart PowerJob services. 3. Verify the /container/list endpoint now properly validates access controls.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict network access to PowerJob management interfaces
iptables -A INPUT -p tcp --dport [POWERJOB_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [POWERJOB_PORT] -j DROP
Reverse Proxy Authentication
allPlace PowerJob behind a reverse proxy with authentication
🧯 If You Can't Patch
- Implement strict network segmentation to isolate PowerJob from untrusted networks
- Deploy web application firewall (WAF) rules to block requests to /container/list with manipulated appId parameters
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to /container/list endpoint with different appId parameters and check if unauthorized data is returned.Check Version:
Check PowerJob version in application logs or via management interfaceVerify Fix Applied:
After patching, attempt the same unauthorized requests and verify they are properly rejected with appropriate error responses.📡 Detection & Monitoring
Log Indicators:
- Multiple requests to /container/list with varying appId parameters
- Unauthorized access attempts to container endpoints
Network Indicators:
- HTTP GET requests to /container/list with unusual appId values
- Traffic patterns suggesting enumeration attempts
SIEM Query:
source="powerjob" AND uri="/container/list" AND (appId!="[expected_value]" OR appId="*")