Cilium Networking Policies Bypass in Bitnami Hubble Relay
Summary
CVE-2023-39347: Cilium NetworkPolicy bypass via pod labels. Affects hubble-relay across 3 version ranges.
< 1.12.14
>= 1.13.0, < 1.13.7
>= 1.14.0, < 1.14.2
Fixed in 1.12.14, 1.13.7 or 1.14.2, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2023-39347 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bitnami Hubble Relay is a networking, observability, and security solution that utilizes Cilium, an eBPF-based dataplane. Cilium provides network policies to restrict traffic based on various constructs such as namespaces, service accounts, and clusters. However, a vulnerability in Cilium allows an attacker with Kubernetes API Server access to bypass these network policies by providing non-existent construct names as pod labels. This can lead to incorrect application of network policies and potential unauthorized access to sensitive resources.
Vulnerability Detail
The vulnerability arises from Cilium's incorrect usage of user-provided pod labels during pod updates. When a pod is updated, Cilium uses the pod labels to select the applicable network policies. By providing a non-existent namespace as the value of the io.kubernetes.pod.namespace label, for example, an attacker can bypass all namespaced CiliumNetworkPolicies for the targeted pod. This vulnerability requires the attacker to have Kubernetes API Server access. The impact of this vulnerability includes the potential for unauthorized access to resources and the circumvention of network restrictions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.12.141.12.14 -
>= 1.13.0, < 1.13.71.13.7 -
>= 1.14.0, < 1.14.21.14.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, an admission webhook can be implemented to prevent pod label updates to the k8s:io.kubernetes.pod.namespace and io.cilium.k8s.policy.* keys. This can help mitigate the risk of incorrect network policy application. Implementing an admission webhook requires knowledge of Kubernetes admission controllers and can be achieved by following the Kubernetes documentation on admission webhooks.
Conclusion
The vulnerability in Cilium's network policy application in Bitnami Hubble Relay can be mitigated by upgrading to the recommended versions of Cilium. Additionally, implementing an admission webhook can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hubble-relay →
FAQ
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides network policies to restrict traffic based on various constructs.
Bitnami Hubble Relay is a networking, observability, and security solution that utilizes Cilium as its underlying technology.
This vulnerability allows an attacker to bypass network policies in Bitnami Hubble Relay by providing non-existent construct names as pod labels.
The vulnerability can lead to unauthorized access to resources and the circumvention of network restrictions in Bitnami Hubble Relay.
To fix this vulnerability, users of Bitnami Hubble Relay should upgrade to Cilium versions 1.14.2, 1.13.7, or 1.12.14.
References
Related vulnerabilities
Recent vulnerabilities recorded for hubble-relay.
