CVE-2022-24817: Code Injection via malicious Kubeconfig in Flux2
Summary
CVE-2022-24817: Improper kubeconfig validation allows arbitrary code execution. Affects kustomize versions >= 0.1.0, < 0.23.0. Fixed in 0.23.0. How to fix ↓
Also tracked for
- flux · Bitnami
- github.com/fluxcd/flux2 · Go
The same CVE-2022-24817 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flux2 is an open and extensible continuous delivery solution for Kubernetes. It allows users to automate the deployment and management of applications on Kubernetes clusters. Flux2 versions between 0.1.0 and 0.29.0 are affected by a vulnerability that enables code injection via a malicious Kubeconfig file. This vulnerability also affects the helm-controller and kustomize-controller components of Flux2. In multi-tenancy deployments, this vulnerability can lead to privilege escalation if the controller's service account has elevated permissions.
Vulnerability Detail
The vulnerability arises from insufficient input validation of the spec.kubeConfig field in Flux Kustomization and HelmRelease objects. An attacker can exploit this by providing a specially crafted Kubeconfig file, which can execute arbitrary code within the controller's pod. This can result in unauthorized access, data manipulation, or even complete compromise of the Kubernetes cluster. The impact is particularly severe in multi-tenancy deployments where the controller's service account has elevated permissions.
How To Fix
Minimum fixed version
0.23.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest versions is not immediately feasible, a workaround is to disable the functionality that allows users to set the spec.kubeConfig field in Flux Kustomization and HelmRelease objects. This can be achieved by implementing Validating Admission webhooks to restrict users from setting this field. Additionally, applying restrictive AppArmor and SELinux profiles on the controller's pod can limit the execution of binaries, reducing the attack surface.
Conclusion
Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to code injection via a malicious Kubeconfig file. This can lead to unauthorized access, data manipulation, and even complete compromise of the Kubernetes cluster. It is crucial to update to the fixed versions (kustomize-controller v0.23.0 and helm-controller v0.19.0) included in flux2 v0.29.0. Workarounds include disabling the spec.kubeConfig field via Validating Admission webhooks and applying restrictive AppArmor and SELinux profiles. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for kustomize →
FAQ
Flux2 is an open and extensible continuous delivery solution for Kubernetes. It automates the deployment and management of applications on Kubernetes clusters.
The vulnerability allows for code injection via a malicious Kubeconfig file. It can lead to unauthorized access, data manipulation, or complete compromise of the Kubernetes cluster. In multi-tenancy deployments, it can also result in privilege escalation.
To fix this vulnerability, update to the latest versions of kustomize-controller (v0.23.0) and helm-controller (v0.19.0), included in flux2 v0.29.0. Alternatively, implement Validating Admission webhooks to restrict users from setting the spec.kubeConfig field, and apply restrictive AppArmor and SELinux profiles on the controller's pod.
Yes, a workaround is to disable the functionality that allows users to set the spec.kubeConfig field in Flux Kustomization and HelmRelease objects. This can be achieved by implementing Validating Admission webhooks.
In addition to updating to the fixed versions and implementing Validating Admission webhooks, it is recommended to apply restrictive AppArmor and SELinux profiles on the controller's pod to limit the execution of binaries.
References
Related vulnerabilities
Recent vulnerabilities recorded for kustomize.
