Marat Gubaidullin

An authenticated user with any role can exploit a path traversal issue where a project file name provided via the project file API is used without proper validation when writing the project to a working copy for a Git commit. By including `../` sequences in the file name, an attacker can write file content outside the intended project directory to any location writable by the process. This can lead to the overwriting of application configuration or files on the application classpath, potentially resulting in remote code execution within the container.

Improper input validation occurs when a deployment is started. The software unmarshals a project's `kubernetes.yaml` and applies all contained resources to the cluster without restricting resource kinds, rejecting security-sensitive pod options, or pinning the target namespace. An authenticated user with any role can cause the application of arbitrary Kubernetes resources accessible to its service account, including pods requesting `hostNetwork`, `hostPID`, `hostIPC`, `hostPath` volumes, host ports, privileged containers, privilege escalation, or added capabilities.