1 line
4.5 KiB
JSON
1 line
4.5 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-vvmq-fwmg-2gjc","published":"2022-05-16T18:13:51Z","modified":"2025-12-02T18:27:40.180830Z","aliases":["BIT-flux-2022-24817","BIT-kustomize-2022-24817","CVE-2022-24817"],"summary":"Improper kubeconfig validation allows arbitrary code execution","details":"Flux2 can reconcile the state of a remote cluster when provided with a [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/#file-references) with the correct access rights. `Kubeconfig` files can define [commands](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target cluster, could craft a `kubeconfig` to execute arbitrary code inside the controller’s container.\n\nIn multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions.\n\n### Impact\n\nWithin the affected versions range, one of the permissions set below would be required for the vulnerability to be exploited:\n- Direct access to the cluster to create Flux `Kustomization` or `HelmRelease` objects and Kubernetes Secrets.\n- Direct access to the cluster to modify existing Kubernetes secrets being used as `kubeconfig` in existing Flux `Kustomization` or `HelmRelease` objects.\n- Direct access to the cluster to modify existing Flux `Kustomization` or `HelmRelease` objects and access to create or modify existing Kubernetes secrets.\n- Access rights to make changes to a configured Flux Source (i.e. Git repository).\n\n### Patches\n\nThis vulnerability was fixed in kustomize-controller [v0.23.0](https://github.com/fluxcd/kustomize-controller/releases/tag/v0.23.0) and helm-controller [v0.19.0](https://github.com/fluxcd/helm-controller/releases/tag/v0.19.0), both included in flux2 [v0.29.0](https://github.com/fluxcd/flux2/releases/tag/v0.29.0). Starting from the fixed versions, both controllers disable the use of command execution from `kubeconfig` files by default, users have to opt-in by adding the flag `--insecure-kubeconfig-exec` to the controller’s command arguments. Users are no longer allowed to refer to files in the controller’s filesystem in the `kubeconfig` files provided for the remote apply feature.\n\n### Workarounds\n\n- The functionality can be disabled via Validating Admission webhooks (e.g. OPA Gatekeeper, Kyverno) by restricting users from being able to set the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects.\n- Applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed.\n\n### Credits\n\nThe Flux engineering team found and patched this vulnerability.\n\n### For more information\n\nIf you have any questions or comments about this advisory please open an issue in the [flux2 repository](http://github.com/fluxcd/flux2).\n","affected":[{"package":{"name":"github.com/fluxcd/flux2","ecosystem":"Go","purl":"pkg:golang/github.com/fluxcd/flux2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"0.29.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vvmq-fwmg-2gjc/GHSA-vvmq-fwmg-2gjc.json"}},{"package":{"name":"github.com/fluxcd/kustomize-controller","ecosystem":"Go","purl":"pkg:golang/github.com/fluxcd/kustomize-controller"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"0.23.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vvmq-fwmg-2gjc/GHSA-vvmq-fwmg-2gjc.json"}},{"package":{"name":"github.com/fluxcd/helm-controller","ecosystem":"Go","purl":"pkg:golang/github.com/fluxcd/helm-controller"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.2.0"},{"fixed":"0.19.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vvmq-fwmg-2gjc/GHSA-vvmq-fwmg-2gjc.json"}}],"references":[{"type":"WEB","url":"https://github.com/fluxcd/flux2/security/advisories/GHSA-vvmq-fwmg-2gjc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24817"},{"type":"PACKAGE","url":"https://github.com/fluxcd/flux2"}],"database_specific":{"cwe_ids":["CWE-94"],"github_reviewed":true,"github_reviewed_at":"2022-05-16T18:13:51Z","nvd_published_at":"2022-05-06T00:15:00Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]} |