CVE-2022-24877: Path Traversal in kustomize-controller
Summary
CVE-2022-24877: Improper path handling in kustomization files allows path traversal. Affects kustomize versions < 0.24.0. Fixed in 0.24.0. How to fix ↓
Also tracked for
- flux · Bitnami
- github.com/fluxcd/flux2 · Go
- github.com/fluxcd/kustomize-controller · Go
The same CVE-2022-24877 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The kustomize-controller is a component of Flux, an open and extensible continuous delivery solution for Kubernetes. It is responsible for managing the customization of Kubernetes resources using Kustomize, a tool for customizing Kubernetes YAML configurations. Kustomize allows users to define and manage overlays, patches, and other modifications to their Kubernetes resources. However, a vulnerability in the kustomize-controller allows for path traversal via a malicious kustomization.yaml file, potentially exposing sensitive data from the controller's pod filesystem and enabling privilege escalation in multi-tenancy deployments.
Vulnerability Detail
The vulnerability (CVE-2022-24877) arises from a lack of proper input validation in the kustomize-controller. An attacker can exploit this vulnerability by crafting a malicious kustomization.yaml file that includes directory traversal sequences. When the kustomize-controller processes this file, it may inadvertently access files outside of the intended scope, potentially exposing sensitive data or allowing for privilege escalation. This vulnerability poses a significant risk in multi-tenancy deployments, where an attacker could leverage the exposed data or escalated privileges to compromise other tenants' resources.
How To Fix
Minimum fixed version
0.24.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can implement automated tooling in their CI/CD pipeline to validate kustomization.yaml files before they are processed by the kustomize-controller. This tooling can check for any directory traversal sequences or other suspicious content in the kustomization.yaml files and reject them if found. By enforcing strict validation, the risk of path traversal attacks can be mitigated.
Conclusion
The path traversal vulnerability in the kustomize-controller poses a significant risk to Kubernetes clusters, particularly in multi-tenancy deployments. It is crucial to update to kustomize-controller version 0.24.0 or later to mitigate this vulnerability. Additionally, implementing automated validation of kustomization.yaml files and following security best practices can further reduce the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kustomize →
FAQ
The vulnerability allows an attacker to expose sensitive data from the kustomize-controller's pod filesystem and potentially escalate privileges in multi-tenancy deployments. This can lead to unauthorized access to sensitive information and compromise the security of the Kubernetes cluster.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software, without requiring access to the code or installation.
At the time of this report, there are no known public exploits for this vulnerability. However, it is essential to apply the recommended fix or workaround to mitigate the risk of exploitation.
No, this vulnerability requires an attacker to have access to the kustomize-controller's pod filesystem. It cannot be exploited remotely without prior access to the Kubernetes cluster.
Yes, you can find more detailed information about this vulnerability in the Bitnami Vulnerability Database (https://github.com/bitnami/vulndb/tree/main/data/kustomize/BIT-kustomize-2022-24877.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for kustomize.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
