CVE-2024-3622
📋 TL;DR
CVE-2024-3622 is a vulnerability in mirror-registry for Quay installations where a default secret is stored in plain text in configuration files. This allows attackers to forge session cookies and gain unauthorized access to Quay instances. Organizations using mirror-registry to deploy Quay are affected.
💻 Affected Systems
- Red Hat Quay
- mirror-registry
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Quay registry with ability to push/pull malicious images, modify existing images, or exfiltrate sensitive container data.
Likely Case
Unauthorized access to Quay instance leading to privilege escalation, data theft, or deployment of malicious containers.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to vulnerable instances.
🎯 Exploit Status
Exploitation requires access to the configuration file containing the plain-text secret.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Red Hat advisory for specific fixed versions
Vendor Advisory: https://access.redhat.com/security/cve/CVE-2024-3622
Restart Required: Yes
Instructions:
1. Update mirror-registry to patched version. 2. Regenerate secrets for affected Quay instances. 3. Restart Quay services.
🔧 Temporary Workarounds
Manual Secret Rotation
linuxManually replace the default secret with a unique, strong secret in configuration files
# Locate configuration file with default secret
# Replace SECRET_KEY value with strong random value
# Restart Quay services
🧯 If You Can't Patch
- Isolate vulnerable Quay instances behind strict network controls
- Implement additional authentication layers and monitor for suspicious access patterns
🔍 How to Verify
Check if Vulnerable:
Check if Quay was deployed using mirror-registry and examine configuration files for default/hardcoded secretsCheck Version:
quay --version or check mirror-registry versionVerify Fix Applied:
Verify configuration files no longer contain default secrets and secrets have been regenerated📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns
- Access from unexpected IP addresses
- Failed login attempts followed by successful access
Network Indicators:
- Unexpected API calls to Quay endpoints
- Suspicious container pull/push activities
SIEM Query:
source="quay" AND (event="authentication" OR event="api_call") | stats count by src_ip, user