PT-2021-4880 · Unknown+1 · Flux Kustomization+4
Adam Korcz
+1
·
Published
2021-11-11
·
Updated
2024-08-21
·
CVE-2021-41254
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
kustomize-controller versions prior to 0.15.0
Description
The issue is related to the kustomize-controller, a Kubernetes operator for running continuous delivery pipelines. It allows users who can create Kubernetes Secrets, Service Accounts, and Flux Kustomization objects to execute commands inside the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be used to run
kubectl commands under the Service Account of kustomize-controller, thus allowing an authenticated Kubernetes user to gain cluster admin privileges. The vulnerability affects multitenant environments where non-admin users have permissions to create Flux Kustomization objects.Recommendations
To resolve the issue, update to kustomize-controller version 0.15.0 or later, which no longer executes shell commands on the container OS and has the
kubectl binary removed from the container image.
As a temporary workaround, consider using a Kubernetes validation webhook, such as Gatekeeper OPA or Kyverno, to prevent the creation of Kubernetes Service Accounts with secrets in namespaces owned by tenants.Exploit
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flux Kustomization
Gatekeeper Opa
Kubernetes
Kyverno
Kustomize-Controller