PT-2022-4594 · Flux · Flux

Pjbgf · Published 2022-08-31 · Updated 2024-08-21 · CVE-2022-36035

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flux (affected versions not specified)

Description The issue is related to the improper handling of user-supplied input in the Flux CLI, which results in a path traversal that can be controlled by the attacker. This allows other applications to replace the Flux deployment information with arbitrary content, which is then deployed into the target Kubernetes cluster. Users sharing the same shell between other applications and the Flux CLI commands could be affected by this issue. In some scenarios, no errors may be presented, which may cause end users not to realize that something is amiss.

Recommendations As a temporary workaround, consider executing Flux CLI in ephemeral and isolated shell environments to ensure no persistent values exist from previous processes. Upgrading to the latest version of the CLI is still the recommended mitigation strategy.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2022-05471

BIT-FLUX-2022-36035

CVE-2022-36035

GHSA-XWF3-6RGV-939R

GO-2022-0960

Affected Products

Flux

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36035.json · Exploit
• https://osv.dev/vulnerability/GO-2022-0960 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36035 · Security Note
• https://osv.dev/vulnerability/GHSA-xwf3-6rgv-939r · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05471 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36035 · Vendor Advisory
• https://github.com/fluxcd/flux2/releases/tag/v0.32.0 · Note
• https://github.com/fluxcd/flux2/security/advisories/GHSA-xwf3-6rgv-939r · Note
• https://github.com/fluxcd/flux2 · Note
• https://t.me/cibsecurity/49107 · Telegram Post