J311Yl0V3U

The BasicAuth authentication component of the Kestra OSS workflow orchestration platform stores passwords using SHA-512, which has a high computation speed. An attacker with read access to the PostgreSQL database can perform an offline brute-force attack to recover the administrator password. In Kubernetes deployments, this can lead to vertical privilege escalation by allowing the attacker to read the cluster ServiceAccount Token and all K8s Secrets.

Incorrect authorization exists within the `/v2` experimental interface.

A missing authorization check in the DataSource API allows unauthenticated users to expose arbitrary data source metadata. This occurs because the API does not require a login to access sensitive metadata information.

Authorized users in a Kubernetes namespace can create a Build resource to control Pod generation in a namespace of their choice, including the operator namespace. This cross-namespace flaw allows users to hijack pods in secure namespaces through an externally controlled reference to a resource in another sphere and authorization bypass via a user-controlled key.

A malicious user with permissions to edit the `local-path-config` ConfigMap in the `local-path-storage` namespace can manipulate the `helperPod.yaml` template. This template is used to create HelperPods during PVC provisioning and cleanup operations but is not sufficiently validated before use. An attacker can inject security-sensitive fields such as `securityContext.privileged`, `hostPath` volumes, and Linux capabilities into the template. When a PVC operation triggers the creation of a HelperPod, the provisioner uses the attacker-controlled template, potentially resulting in a privileged pod running on the target node with the host root filesystem mounted. This allows the attacker to access sensitive host files, read ServiceAccount tokens from other pods on the same node, access other tenants' local-path volume data, or modify files on the host node.

A server-side request forgery (SSRF) issue exists in the APICall feature. The `URL` field within a Policy's ServiceCall configuration lacks validation, allowing a user with namespace-level Policy creation permissions to force the system to make HTTP requests to arbitrary internal resources, such as cloud metadata endpoints or resources belonging to other tenants. This is a Confused Deputy problem, where the system uses its high-privilege cluster-wide ServiceAccount to execute requests. Consequently, sensitive data, including cloud IAM credentials and secrets from other tenants, may be returned in the PolicyReport and accessed by the attacker, compromising multi-tenant isolation.

Kube-router's proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node's network configuration. This impacts multi-tenant clusters where untrusted users have namespace-scoped permissions to create or modify Services. The `buildServicesInfo()` function copies IPs from `Service.spec.externalIPs` and `status.loadBalancer.ingress` without validating them against the `--service-external-ip-range` parameter. An attacker can bind arbitrary VIPs on all cluster nodes or cause denial of service to critical cluster services such as kube-dns. The `--service-external-ip-range` parameter is only used by the netpol module and is not checked by the proxy module. This allows attackers to potentially hijack traffic or disrupt DNS services. The vulnerability can be exploited by creating a Service with an externalIP matching the kube-dns ClusterIP, redirecting all DNS queries to attacker-controlled pods. The issue is not unique to kube-router, as the upstream Kubernetes project identified a similar issue as CVE-2020-8554.

Nuclio's Shell Runtime component contains a command injection issue. When a function is invoked via HTTP, the runtime reads the `X-Nuclio-Arguments` header and directly incorporates its value into shell commands without validation or sanitization. This allows attackers with function invocation permissions to inject malicious commands, potentially executing arbitrary code with root privileges in function containers, stealing ServiceAccount Tokens with cluster-admin level permissions, and ultimately gaining complete control over the Kubernetes cluster. The vulnerability stems from the lack of validation when processing user-supplied arguments in the `getCommandArguments` function and the subsequent execution of these arguments using `sh -c`. Attackers can exploit this by crafting malicious payloads in the `X-Nuclio-Arguments` header, leveraging shell metacharacters like semicolons, pipes, and backticks to inject arbitrary commands. The vulnerability affects all versions that include the Shell Runtime component. A successful exploit can lead to complete cluster compromise, including data breaches, supply chain attacks, and ransomware deployment.