CVE-2021-3495: Access control flaw in Kiali
Summary
CVE-2021-3495: Access control flaw in Kiali. Affects github.com/kiali/kiali versions < 1.33.0. Fixed in 1.33.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kiali is an open-source project written in Go that provides observability and visualization for the Istio service mesh. It offers a web-based user interface to monitor and manage the components of an Istio service mesh. Kiali allows users to view service graphs, trace requests, and analyze metrics. It is widely used in Kubernetes environments to enhance the observability of microservices-based applications.
Vulnerability Detail
An access control flaw has been identified in the kiali-operator component of Kiali. This vulnerability, tracked as CVE-2021-3495, exists in versions prior to 1.33.0. Attackers with basic access to the cluster can exploit this flaw by deploying a kiali operand, enabling them to deploy a specific image anywhere in the cluster. This unauthorized deployment can potentially grant the attacker access to privileged service account tokens. The primary risks associated with this vulnerability include data confidentiality and integrity, as well as system availability.
How To Fix
Minimum fixed version
1.33.0
This is the first release that contains the fix.
go get github.com/kiali/kiali@v1.33.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the kiali-operator component by implementing additional access controls within their Kubernetes cluster. This can be achieved by modifying the cluster's RBAC (Role-Based Access Control) configuration to limit the privileges of users or service accounts associated with the kiali-operator. However, applying this workaround may limit the functionality of Kiali and is not a permanent solution. It is strongly recommended to upgrade to the latest patched version of Kiali as soon as possible.
Conclusion
The access control flaw in Kiali poses a significant risk to the confidentiality, integrity, and availability of data in Kubernetes environments. Upgrading to the latest version of Kiali (1.33.0 or later) is crucial to patch this vulnerability and prevent unauthorized image deployments. Implementing additional access controls as a temporary workaround can provide some mitigation, but it is not a permanent solution. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/kiali/kiali →
FAQ
Kiali is an open-source project that provides observability and visualization for the Istio service mesh. It offers a web-based user interface to monitor and manage the components of an Istio service mesh.
The vulnerability allows attackers with basic access to the cluster to deploy a specific image anywhere in the cluster, potentially gaining access to privileged service account tokens. This can lead to data confidentiality and integrity breaches, as well as system availability issues.
Versions of Kiali prior to 1.33.0 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade Kiali to version 1.33.0 or later. Follow the official upgrade instructions provided by the Kiali project.
As a temporary workaround, you can restrict access to the kiali-operator component by modifying the cluster's RBAC configuration. However, upgrading to the latest version of Kiali is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/kiali/kiali.
