B0B0Haha

The BasicAuth authentication component of the Kestra OSS workflow orchestration platform stores passwords using SHA-512, which has a high computation speed. An attacker with read access to the PostgreSQL database can perform an offline brute-force attack to recover the administrator password. In Kubernetes deployments, this can lead to vertical privilege escalation by allowing the attacker to read the cluster ServiceAccount Token and all K8s Secrets.

Incorrect authorization exists within the `/v2` experimental interface.

A missing authorization check in the DataSource API allows unauthenticated users to expose arbitrary data source metadata. This occurs because the API does not require a login to access sensitive metadata information.

The Capsule Controller runs with cluster-admin privileges. A flaw exists in the `HandleSection()` function within the `internal/controllers/resources/processor.go` file, where the processing logic for `TenantResource` `RawItems` fails to properly validate resource scopes. While the controller attempts to set a namespace using `obj.SetNamespace()`, this action is ignored by the Kubernetes API for cluster-scoped resources. Consequently, users with Tenant Owner privileges can leverage the controller's elevated permissions to create cluster-scoped resources, such as `ClusterRole` and `ValidatingWebhookConfiguration`, which they are not authorized to create directly. This can lead to cross-tenant privilege escalation, cluster-level attacks, theft of sensitive data from all tenants via malicious webhooks, or cluster-wide denial of service.

Authorized users in a Kubernetes namespace can create a Build resource to control Pod generation in a namespace of their choice, including the operator namespace. This cross-namespace flaw allows users to hijack pods in secure namespaces through an externally controlled reference to a resource in another sphere and authorization bypass via a user-controlled key.

A malicious user with permissions to edit the `local-path-config` ConfigMap in the `local-path-storage` namespace can manipulate the `helperPod.yaml` template. This template is used to create HelperPods during PVC provisioning and cleanup operations but is not sufficiently validated before use. An attacker can inject security-sensitive fields such as `securityContext.privileged`, `hostPath` volumes, and Linux capabilities into the template. When a PVC operation triggers the creation of a HelperPod, the provisioner uses the attacker-controlled template, potentially resulting in a privileged pod running on the target node with the host root filesystem mounted. This allows the attacker to access sensitive host files, read ServiceAccount tokens from other pods on the same node, access other tenants' local-path volume data, or modify files on the host node.

The UI server WebSocket accepts connections from all origins by default, exposing several endpoints. A malicious website visited by a developer using a browser can establish a cross-origin WebSocket connection to 'ws://127.0.0.1:8090'. This allows unauthorized access to the following endpoints: - '/api/logs' to stream real-time pod logs - '/api/enter' to open an interactive shell inside the running pod - '/api/command' to execute pre-defined pipeline commands

The Cookie Rewriting feature is susceptible to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can provide malicious values in the `spec.routes[].cookieRewritePolicies[].pathRewrite.value` or `spec.routes[].services[].cookieRewritePolicies[].pathRewrite.value` variables, leading to arbitrary code execution in the Envoy proxy. This occurs because user-controlled values are interpolated into Lua source code using Go text/template without sufficient sanitization. While the injected code executes only on the attacker's own route, it can be used to read Envoy xDS client credentials from the filesystem—potentially exposing TLS certificates and private keys of other tenants—or cause a denial of service for other tenants sharing the Envoy instance.

A server-side request forgery (SSRF) issue exists in the APICall feature. The `URL` field within a Policy's ServiceCall configuration lacks validation, allowing a user with namespace-level Policy creation permissions to force the system to make HTTP requests to arbitrary internal resources, such as cloud metadata endpoints or resources belonging to other tenants. This is a Confused Deputy problem, where the system uses its high-privilege cluster-wide ServiceAccount to execute requests. Consequently, sensitive data, including cloud IAM credentials and secrets from other tenants, may be returned in the PolicyReport and accessed by the attacker, compromising multi-tenant isolation.

The '/registercrd' endpoint in the kubeconfiggenerator component is susceptible to command injection. The issue occurs because the component utilizes the `subprocess.Popen()` function with the `shell=True` parameter to execute shell commands, directly concatenating the user-supplied `chartName` parameter into the command string without proper sanitization or validation. This allows an attacker to execute arbitrary shell commands by providing a malicious value for the `chartName` variable.

KubePlus versions 4.1.4 contain a Server-Side Request Forgery (SSRF) issue within the mutating webhook and kubeconfiggenerator components when handling the `chartURL` field of ResourceComposition resources. The `chartURL` field is URL-encoded without proper validation of the target address. Specifically, when the kubeconfiggenerator component uses `wget` to download charts, the `chartURL` is directly incorporated into the command, enabling attackers to inject `wget`'s `--header` option and achieve arbitrary HTTP header injection. The API endpoint used for chart downloads is not specified. The vulnerable parameter is `chartURL`.

A SQL Injection issue exists in SchemaHero version 0.23.0. The issue is due to a flaw in the `mysqlColumnAsInsert` function within the `plugins/mysql/lib/column.go` file, specifically related to the `column` parameter. This allows for potential manipulation of SQL queries. The `column` parameter is vulnerable.

A SQL Injection issue exists in SchemaHero version 0.23.0. The issue is located in the `columnAsInsert` function within the `plugins/postgres/lib/column.go` file, specifically through the `column` parameter. The vulnerability allows for potential manipulation of SQL queries through the `column` parameter.

Kube-router's proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node's network configuration. This impacts multi-tenant clusters where untrusted users have namespace-scoped permissions to create or modify Services. The `buildServicesInfo()` function copies IPs from `Service.spec.externalIPs` and `status.loadBalancer.ingress` without validating them against the `--service-external-ip-range` parameter. An attacker can bind arbitrary VIPs on all cluster nodes or cause denial of service to critical cluster services such as kube-dns. The `--service-external-ip-range` parameter is only used by the netpol module and is not checked by the proxy module. This allows attackers to potentially hijack traffic or disrupt DNS services. The vulnerability can be exploited by creating a Service with an externalIP matching the kube-dns ClusterIP, redirecting all DNS queries to attacker-controlled pods. The issue is not unique to kube-router, as the upstream Kubernetes project identified a similar issue as CVE-2020-8554.

Nuclio's Shell Runtime component contains a command injection issue. When a function is invoked via HTTP, the runtime reads the `X-Nuclio-Arguments` header and directly incorporates its value into shell commands without validation or sanitization. This allows attackers with function invocation permissions to inject malicious commands, potentially executing arbitrary code with root privileges in function containers, stealing ServiceAccount Tokens with cluster-admin level permissions, and ultimately gaining complete control over the Kubernetes cluster. The vulnerability stems from the lack of validation when processing user-supplied arguments in the `getCommandArguments` function and the subsequent execution of these arguments using `sh -c`. Attackers can exploit this by crafting malicious payloads in the `X-Nuclio-Arguments` header, leveraging shell metacharacters like semicolons, pipes, and backticks to inject arbitrary commands. The vulnerability affects all versions that include the Shell Runtime component. A successful exploit can lead to complete cluster compromise, including data breaches, supply chain attacks, and ransomware deployment.

Kruise allows automated management of applications on Kubernetes. A flaw exists in the PodProbeMarker functionality where the webhook validation does not restrict the 'Host' field in custom probe configurations using TCPSocket or HTTPGet handlers. Because kruise-daemon runs with hostNetwork enabled, it executes probes from the node's network namespace. An attacker with permission to create PodProbeMarkers can specify arbitrary 'Host' values to trigger Server-Side Request Forgery (SSRF) from the node, perform port scanning, and receive response feedback through NodePodProbe status messages. The vulnerability allows access to node-local services, cloud metadata, and internal network resources. The `tcpSocket` probe remains vulnerable, while `httpGet` probes are rejected by the webhook in OpenKruise v1.8.0. The vulnerable component is the `PodProbeMarker` and the affected function is `newTCPSocketProber`.

Kargo manages and automates the promotion of software artifacts. The batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. Specially crafted payloads can allow an attacker to inject arbitrary resources into the underlying namespace of an existing Project using the API server's own permissions when this behavior is not intended. This can be exploited to elevate permissions, potentially leading to remote code execution or secret exfiltration. Exfiltrated artifact repository credentials could be used for further attacks. In some Kubernetes cluster configurations, elevated permissions may enable remote code execution or secret exfiltration using `kubectl`. The **API Endpoints** affected are the batch resource creation endpoints of both the legacy gRPC API and the newer REST API. The issue stems from the logic within these endpoints when processing multi-document YAML payloads. An attacker can leverage this to inject resources into existing Projects.

Kargo manages and automates the promotion of software artifacts. The authorization model includes a 'promote' verb intended to control access to promotion pipelines. While correctly enforced in the gRPC API, three endpoints in the REST API omit this check, relying solely on standard Kubernetes RBAC. This allows users with standard permissions, but without explicit 'promote' access, to bypass intended authorization boundaries. The affected **API Endpoints** are /v1beta1/projects/{project}/freight/{freight}/approve, /v1beta1/projects/{project}/stages/{stage}/promotions, and /v1beta1/projects/{project}/stages/{stage}/promotions/downstream. The issue stems from a missing authorization check for the 'promote' verb on these endpoints.

The Air Traffic Controller (ATC) component of Yoke lacks proper authentication mechanisms for its webhook endpoints. This allows any pod within the cluster network to send AdmissionReview requests directly to the webhook, bypassing Kubernetes API Server authentication. Attackers can exploit this to trigger WASM module execution in the ATC controller context without authorization. The vulnerable endpoints include '/validations/{airway}', '/validations/resources', '/validations/flights.yoke.cd', '/validations/airways.yoke.cd', and '/crdconvert/{airway}'. The issue stems from the absence of TLS client certificate verification, request source validation, or any form of authentication middleware in the HTTP handler implementation. An attacker can send crafted AdmissionReview requests to these endpoints, potentially leading to unauthorized WASM execution and, combined with other issues, the creation of arbitrary Kubernetes resources. The impact includes potential confidentiality, integrity, and availability concerns.

Yoke's Air Traffic Controller (ATC) component contains a flaw that allows users with Custom Resource (CR) create/update permissions to execute arbitrary WASM code. This is achieved by injecting a malicious URL through the `overrides.yoke.cd/flight` annotation. The ATC controller downloads and executes the WASM module without validating the URL, potentially enabling attackers to create arbitrary Kubernetes resources or escalate privileges. The vulnerability resides in the handling of the `overrides.yoke.cd/flight` annotation, where the controller directly uses the user-provided URL without proper validation. The permission check only verifies `update` permission on `airways` resources, failing to prevent the execution of arbitrary WASM code. A Proof of Concept (PoC) demonstrates the creation of a malicious WASM module that creates a ConfigMap named `stolen-credentials` in the cluster, proving arbitrary code execution. The vulnerability is categorized as Remote Code Execution (RCE) / Code Injection. Attackers with CR create/update permissions and network access to host malicious WASM can exploit this issue. The impact includes potential compromise of confidentiality, integrity, and availability.