PT-2022-11916 · Spinnaker · Spinnaker

Sébastien Kaul · Published 2022-01-04 · Updated 2022-01-14 · CVE-2021-43832

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spinnaker (affected versions not specified)

Description Spinnaker, an open source, multi-cloud continuous delivery platform, has improper permissions allowing pipeline creation and execution. This issue enables an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If Role-based access control (RBAC) is not set up within Spinnaker, this allows remote execution and access to deploy almost any resources on any account.

Recommendations Upgrade to the latest releases of the supported branches as soon as possible. If unable to upgrade, enable RBAC on all accounts and applications to mitigate the ability of a pipeline to affect any accounts. Block application access unless permissions are enabled. Restrict all application creation via appropriate wildcards.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-43832

GHSA-9H7C-RFRP-GVGP

Affected Products

Spinnaker

References · 4

• https://osv.dev/vulnerability/CVE-2021-43832 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43832 · Security Note
• https://github.com/spinnaker/spinnaker/security/advisories/GHSA-9h7c-rfrp-gvgp · Note
• https://t.me/cibsecurity/34952 · Telegram Post