QID 731075

Date Published: 2024-01-18

QID 731075: Harshicorp Nomad UI Accessible Without Authentication

The Nomad Web UI offers a web experience for inspecting a Nomad cluster. It's built into the Nomad binary and is served alongside the API. With zero additional configuration, you can use the Web UI instead of the CLI to inspect cluster state and submit and manage jobs.

If you visit the Nomad server address in a web browser, you will be redirected to the Web UI, which is served under /ui. If you are unsure what port the Nomad HTTP API is running on, try the default port: 4646.

QID Detection Logic (Un-Authenticated)
This QID sends GET request on default web address to check for sensitive information about jobs configured.

A remote attacker could access Nomad UI to perform malicious activities.

CVSS V3 rated as Critical - 10 severity.

CVSS V2 rated as Critical - 10 severity.

Solution

Customers are advised not to use default setting configuration. Apply authentication to access jobs.

Vendor References

HarshiCorp Nomad - developer.hashicorp.com/nomad/tutorials/web-ui/web-ui-access

CVEs related to QID 731075

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].