Authentication Bypass in knowns Management API

The knowns application, in versions prior to 0.30.0, contains a critical authentication bypass vulnerability in its management API component. By default, this API is configured to listen on all network interfaces without requiring any form of authentication or credentials upon fresh installation. This misconfiguration allows unauthenticated remote attackers to interact with sensitive administrative endpoints. Specifically, an attacker can access the /api/tunnel/start endpoint to provision a new, unauthorized public tunnel. This action can be used to republish the internal management API to a publicly accessible address, effectively bypassing internal network boundaries and enabling further unauthorized access or control over the host system. Given the default behavior of exposing the API on all interfaces, this threat is highly accessible to any actor capable of reaching the service over the network.

Impact

Successful exploitation allows for the unauthorized creation of external tunnels, potentially exposing internal-only services or management interfaces to the public internet. This can lead to unauthorized configuration changes, complete takeover of the knowns application instance, and lateral movement within the network. This vulnerability carries a CVSS v3.1 base score of 9.8.

Recommendation

• Upgrade the knowns application to version 0.30.0 or later immediately to enforce authentication requirements on the management API.
• Implement network access control lists (ACLs) to restrict access to the knowns management API port to trusted internal management subnets only.
• Review network logs for unexpected inbound HTTP requests to the /api/tunnel/start endpoint, which is a strong indicator of unauthorized tunnel provisioning.