Koreasecurity

An attacker who gains control of the backup object-storage backend can upload a malicious backup tarball. This tarball can contain parent-directory paths that allow files to escape the intended extraction directory during the restore process, enabling the overwriting of sensitive files within the Velero pod filesystem.

The OAuth2 HTTP filter uses AES-256-CBC in its `encrypt()` and `decrypt()` functions without an authentication tag, such as HMAC or AEAD (Authenticated Encryption with Associated Data). This implementation allows the `/callback` endpoint to return different HTTP responses based on decryption success (HTTP 302) or padding failure (HTTP 401), creating a padding oracle. An attacker with access to the encrypted `CodeVerifier` cookie can recover the plaintext PKCE `code verifier` through approximately 6,200 requests, which can then be used with a stolen authorization code to obtain a victim's access token.

The `apiCall` feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. Because the service URL lacks validation, it can be directed to attacker-controlled servers. Since the admission controller ServiceAccount possesses permissions to patch webhook configurations, the theft of this token can result in full cluster compromise.

When a RequestAuthentication resource is created with a `jwksUri` pointing to an internal service, istiod performs an unauthenticated HTTP GET request to that URL without filtering localhost or link-local IP addresses. This behavior can lead to the distribution of sensitive data to Envoy proxies through the xDS configuration.

A command injection issue exists in the HyperV machine backend within the file `pkg/machine/hyperv/stubber.go`. The VM image path is inserted into a PowerShell double-quoted string without sanitization, which allows for `$()` subexpression injection. Since PowerShell evaluates subexpressions inside double-quoted strings before executing the outer command, an attacker who controls the VM image path via a crafted machine name or image directory can execute arbitrary PowerShell commands. This occurs with the privileges of the Podman process, which on typical Windows installations results in SYSTEM-level code execution. This issue exclusively affects Windows.

MinIO has a JWT algorithm confusion issue in its OpenID Connect authentication. An attacker who knows the OIDC `ClientSecret` can forge identity tokens and obtain S3 credentials with any policy, including `consoleAdmin`. This allows an attacker to impersonate any user identity, access, modify, or delete data within the MinIO deployment. The attack is deterministic and has a 100% success rate. The attacker must have access to the OIDC `ClientSecret`, which may be found in environment variables, frontend OAuth configurations, mobile app bundles, CI/CD pipelines, or shared configuration files.

**Name of the Vulnerable Software and Affected Versions** Tekton Pipelines versions 1.0.0 through 1.10.0