PT-2021-12793 · Kubernetes · Kubernetes Secrets Store Csi Driver

Tam7T + 1 · Published 2021-01-21 · Updated 2022-02-15 · CVE-2020-8568

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Kubernetes Secrets Store CSI Driver versions v0.0.15 through v0.0.16

Description: The issue allows an attacker who can modify a SecretProviderClassPodStatus/Status resource to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets. Modifying pod status enables host directory traversal.

Recommendations: For versions v0.0.15 and v0.0.16, consider restricting access to the SecretProviderClassPodStatus/Status resource to prevent modification by unauthorized parties. As a temporary workaround, consider disabling the ability to modify SecretProviderClassPodStatus/Status resources until a patch is available. Restrict access to paths under var/lib/kubelet/pods to minimize the risk of exploitation.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-24

CWE-20

CWE-22

Related Identifiers

CVE-2020-8568

GHSA-5CGX-VHFP-6CF9

GO-2022-0629

Affected Products

Kubernetes Secrets Store Csi Driver

References · 11

• https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/378 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-8568 · Security Note
• https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/Cb9cvymTzl4 · Patch
• https://osv.dev/vulnerability/GHSA-5cgx-vhfp-6cf9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8568 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0629 · Vendor Advisory
• https://github.com/kubernetes-sigs/secrets-store-csi-driver/pull/371 · Note
• https://github.com/kubernetes-sigs/secrets-store-csi-driver/commit/c2cbb19e2eef16638fa0523383788a4bc22231fd · Note
• https://github.com/kubernetes-sigs/secrets-store-csi-driver · Note
• https://pkg.go.dev/vuln/GO-2022-0629 · Note
• https://t.me/cibsecurity/22506 · Telegram Post