CVE-2022-24877: Improper path handling in kustomization files allows path traversal in github.com/fluxcd/kustomize-controller
Summary
CVE-2022-24877: Improper path handling in kustomization files allows path traversal. Affects github.com/fluxcd/kustomize-controller versions < 0.24.0. Fixed in 0.24.0. How to fix ↓
Also tracked for
- flux · Bitnami
- github.com/fluxcd/flux2 · Go
- kustomize · Bitnami
The same CVE-2022-24877 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kustomize-controller is a component that enables the use of Kustomize's functionality when applying Kubernetes declarative state onto a cluster. It allows users to define and manage customizations to Kubernetes resources using a kustomization.yaml file. This vulnerability affects versions of the kustomize-controller and flux2 packages prior to v0.24.0 and v0.29.0 respectively. The vulnerability arises from improper path handling in kustomization files, which can lead to path traversal attacks. This can be exploited by a malicious user with write access to a Flux source, allowing them to expose sensitive data from the controller's pod filesystem. In multi-tenancy deployments, this can result in privilege escalation if the controller's service account has elevated permissions.
Vulnerability Detail
The vulnerability allows a malicious user to use built-in features and a specially crafted kustomization.yaml file to traverse the file system and access sensitive data from the controller's pod filesystem. This can lead to the exposure of confidential information and potential privilege escalation in multi-tenancy deployments. The vulnerability was fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0 by introducing a new Kustomize file system implementation that ensures all files being handled are contained within the Kustomization working directory, blocking references to any files that do not meet that requirement.
How To Fix
Minimum fixed version
0.24.0
This is the first release that contains the fix.
go get github.com/fluxcd/kustomize-controller@v0.24.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can employ automated tooling like conftest to enforce specific policies on their kustomization.yaml files and block access to sensitive path locations. This can be integrated into the CI/CD pipeline to ensure compliance and prevent exploitation of the vulnerability.
Conclusion
The vulnerability in kustomize-controller and flux2 allows a malicious user to perform path traversal attacks and access sensitive data from the controller's pod filesystem. It is crucial to update to the fixed versions and review kustomization.yaml files to prevent exploitation. Employing automated tooling like conftest can help enforce policies and block access to sensitive paths. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/fluxcd/kustomize-controller →
FAQ
The vulnerability allows a malicious user to access sensitive data from the controller's pod filesystem and potentially escalate privileges in multi-tenancy deployments.
To fix this vulnerability, update to kustomize-controller v0.24.0 or later and flux2 v0.29.0 or later. Review and update kustomization.yaml files to conform to specific policies and block access to sensitive path locations. Employ automated tooling like conftest to enforce policy compliance.
A workaround is to use automated tooling like conftest to enforce policies on kustomization.yaml files and block access to sensitive path locations.
There are no known public exploits of this vulnerability at the time of this advisory.
You can find more information about this vulnerability in the GitHub Advisory Database at the provided source link.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fluxcd/kustomize-controller.
