Zot IdP समूह सदस्यता रद्द करना zotregistry.dev/zot में अनदेखा किया गया

This vulnerability allows an attacker to circumvent the intended revocation process for group memberships within the Zot identity provider (IdP). If a user's group membership is revoked, the system should prevent them from accessing resources associated with that group. However, due to this flaw, a revoked user may retain access. The potential impact is unauthorized access to sensitive data or functionality controlled by the group. The blast radius depends on the permissions granted to the affected group; a highly privileged group could lead to significant data breaches or system compromise. This bypass could be exploited in conjunction with other vulnerabilities to escalate privileges or gain broader access.

Organizations using zotregistry.dev/zot as an identity provider, particularly those relying on group memberships for access control, are at risk. This includes deployments where group revocation is a critical security control. Shared hosting environments utilizing Zot are also potentially vulnerable.

• go / binary: Use go build to compile the Zot source code and then analyze the resulting binary for potential bypass logic related to group membership revocation. • go / supply-chain: Examine dependencies and submodules used by Zot for potential vulnerabilities that could be exploited in conjunction with this issue. • generic web: Monitor access logs for unusual activity from users who have recently had their group memberships revoked. Look for requests to resources that should be inaccessible.

1. 2025-01-28Disclosure

   disclosure

1. आरक्षित2025-01-13
2. प्रकाशित2025-01-28
3. संशोधित2026-02-04
4. EPSS अद्यतन2026-04-02

The primary mitigation is to upgrade to version 2.1.2 or later of zotregistry.dev/zot. If upgrading immediately is not possible, consider implementing temporary workarounds. While a direct workaround is not readily available, carefully review and restrict access permissions granted to groups to minimize the potential impact of a successful bypass. Monitor Zot logs for unusual access patterns or attempts to access resources after group revocation. Consider implementing stricter authentication and authorization policies to limit the potential damage from unauthorized access.