Konflux UI Proxy Configuration Injection Vulnerability

The Konflux UI proxy contains a vulnerability where hostname values defined in the KonfluxUI custom resource are inserted directly into proxy configuration files without adequate validation or sanitization. This flaw allows an authenticated user with permissions to modify the custom resource to inject malicious configuration directives. Successfully exploiting this enables an attacker to bypass authentication and authorization controls, potentially exposing internal backend services. Furthermore, providing malformed input can cause the configuration generator to fail, resulting in a denial of service (DoS) by preventing the proxy from starting.

Impact

Successful exploitation may allow unauthorized access to internal backend services by bypassing authentication controls, or cause a denial of service by rendering the proxy service unable to initialize.