Red Hat fog-kubevirt Man-in-the-Middle Vulnerability Due to Disabled Certificate Validation

A Man-in-the-Middle (MITM) vulnerability has been identified in Red Hat fog-kubevirt, a component used by Red Hat Satellite to manage OpenShift Virtualization/KubeVirt. This vulnerability arises from disabled certificate validation, allowing remote attackers to intercept and potentially alter sensitive communications between Satellite and OpenShift. As a result, there is a risk of information disclosure and compromise of data integrity.

Impact

Exploitation of this vulnerability could lead to a Man-in-the-Middle attack, allowing an attacker to intercept and modify communications between Red Hat Satellite and OpenShift, thereby compromising the integrity of the data being transmitted and potentially disclosing sensitive information.

Reproduction

To reproduce this vulnerability, configure OpenShift Virtualization/KubeVirt in Red Hat Satellite and provide any CA certificate. Connections will succeed even if the CA is incorrect, demonstrating the disabled certificate validation. This flaw occurs because, although the client is supposed to verify SSL certificates, the verification is turned off, allowing for MITM attacks.