PT-2022-2954 · Unknown · Capsule-Proxy

Prometherion · Published 2022-02-22 · Updated 2024-08-21 · CVE-2022-23652

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions capsule-proxy versions prior to 0.2.1

Description The issue is related to the capsule-proxy, a reverse proxy for Capsule Operator that provides multi-tenancy in Kubernetes. An attacker with proper authentication may use a malicious Connection header to start a privilege escalation attack towards the Kubernetes API Server, potentially exploiting the cluster-admin Role bound to capsule-proxy. There are no known workarounds for this issue.

Recommendations For versions prior to 0.2.1, upgrade to version 0.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the capsule-proxy to minimize the risk of exploitation. Avoid using malicious Connection headers in the affected API endpoint until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2022-03563

CVE-2022-23652

GHSA-9CWV-CPPX-MQJM

GO-2022-0329

Affected Products

Capsule-Proxy

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23652.json · Exploit
• 🔥 https://github.com/clastix/capsule-proxy/issues/188 · Exploit
• https://github.com/clastix/capsule-proxy/commit/efe91f68ebf8a9e3d21491dc57da7b8a746415d8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23652 · Security Note
• https://osv.dev/vulnerability/GHSA-9cwv-cppx-mqjm · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0329 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03563 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23652 · Vendor Advisory
• https://github.com/clastix/capsule-proxy/security/advisories/GHSA-9cwv-cppx-mqjm · Note
• https://github.com/clastix/capsule-proxy · Note
• https://t.me/cvenotify/27554 · Telegram Post
• https://t.me/cibsecurity/37902 · Telegram Post