CyberRota Analysis
AI-GeneratedThe vulnerability affects the zot container image and artifact registry prior to version 2.1.18, where the bearer authentication handler improperly maps HTTP methods, allowing unauthorized DELETE requests to execute without the necessary permissions. This flaw enables remote attackers with limited bearer tokens to delete manifests and blobs, compromising image availability and altering repository history. Organizations using affected versions should prioritize upgrading to 2.1.18 to mitigate the risk of unauthorized deletions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the fine-grained DistSpecAuthzHandler path in pkg/api/authz.go, while DeleteManifest and DeleteBlob perform no independent delete-permission check. A remote attacker with a bearer token limited to pull and push actions can therefore delete manifests and blobs within the token's repository scope, making images unavailable and allowing repository history to be altered despite the token lacking delete authorization. This issue is fixed in version 2.1.18.