PT-2021-4880 · Unknown+1 · Flux Kustomization+4

Adam Korcz

+1

·

Published

2021-11-11

·

Updated

2024-08-21

·

CVE-2021-41254

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions kustomize-controller versions prior to 0.15.0
Description The issue is related to the kustomize-controller, a Kubernetes operator for running continuous delivery pipelines. It allows users who can create Kubernetes Secrets, Service Accounts, and Flux Kustomization objects to execute commands inside the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be used to run kubectl commands under the Service Account of kustomize-controller, thus allowing an authenticated Kubernetes user to gain cluster admin privileges. The vulnerability affects multitenant environments where non-admin users have permissions to create Flux Kustomization objects.
Recommendations To resolve the issue, update to kustomize-controller version 0.15.0 or later, which no longer executes shell commands on the container OS and has the kubectl binary removed from the container image. As a temporary workaround, consider using a Kubernetes validation webhook, such as Gatekeeper OPA or Kyverno, to prevent the creation of Kubernetes Service Accounts with secrets in namespaces owned by tenants.

Exploit

Fix

OS Command Injection

Weakness Enumeration

Related Identifiers

BDU:2021-05613
BIT-KUSTOMIZE-2021-41254
CVE-2021-41254
GHSA-35RF-V2JV-GFG7
GO-2022-0260

Affected Products

Flux Kustomization
Gatekeeper Opa
Kubernetes
Kyverno
Kustomize-Controller