CVE-2023-39347: Vulnerability in hubble-ui-backend package allows incorrect network policies
Summary
CVE-2023-39347: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Affects hubble-ui-backend across 3 version ranges.
< 1.12.14
>= 1.13.0, < 1.13.7
>= 1.14.0, < 1.14.2
Fixed in 1.12.14, 1.13.7 or 1.14.2, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2023-39347 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
hubble-ui-backend is a package developed by Bitnami that provides networking, observability, and security features. It utilizes Cilium, an eBPF-based dataplane, to implement its functionality. Cilium is responsible for enforcing network policies within Kubernetes clusters. These policies control the traffic between pods and can be used to restrict access based on various constructs such as namespaces, service accounts, and clusters. However, a vulnerability in hubble-ui-backend allows an attacker with Kubernetes API Server access to update pod labels and cause Cilium to apply incorrect network policies.
Vulnerability Detail
The vulnerability arises from the incorrect usage of user-provided pod labels during pod updates. When a pod is updated, Cilium uses the pod labels to select the applicable network policies. However, if the attacker provides non-existent construct names as labels, it bypasses all network policies associated with those constructs. For example, providing a non-existent namespace as the value of the io.kubernetes.pod.namespace label results in none of the namespaced CiliumNetworkPolicies applying to the pod. This can lead to unauthorized access and potential security breaches. The issue has been addressed in Cilium versions 1.14.2, 1.13.7, and 1.12.14.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.12.141.12.14 -
>= 1.13.0, < 1.13.71.13.7 -
>= 1.14.0, < 1.14.21.14.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, an admission webhook can be used to prevent pod label updates to the k8s:io.kubernetes.pod.namespace and io.cilium.k8s.policy.* keys. This prevents attackers from exploiting the vulnerability by providing non-existent construct names as labels. Implementing the admission webhook requires modifying the Kubernetes configuration and deploying the webhook server. Detailed instructions can be found in the Cilium documentation.
Conclusion
The vulnerability in hubble-ui-backend allows attackers with Kubernetes API Server access to apply incorrect network policies by providing non-existent construct names as pod labels. This can lead to unauthorized access and potential security breaches. Users are advised to upgrade to the latest version of Cilium (1.14.2, 1.13.7, or 1.12.14) to fix the vulnerability. Alternatively, implementing an admission webhook can serve as a workaround to prevent pod label updates that exploit the vulnerability.
See every vulnerability recorded for hubble-ui-backend →
FAQ
hubble-ui-backend is a package developed by Bitnami that provides networking, observability, and security features for Kubernetes clusters.
Cilium is an eBPF-based dataplane used by hubble-ui-backend to enforce network policies within Kubernetes clusters.
The vulnerability allows an attacker to provide non-existent construct names as pod labels, bypassing the network policies associated with those constructs. This can lead to unauthorized access and potential security breaches.
To fix the vulnerability, users should upgrade to the latest version of Cilium (1.14.2, 1.13.7, or 1.12.14) and follow the upgrade instructions provided by Cilium.
Yes, a workaround involves implementing an admission webhook to prevent pod label updates to specific keys. Detailed instructions can be found in the Cilium documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for hubble-ui-backend.
