PT-2023-27910 · Cilium · Cilium
Odinuge
·
Published
2023-09-26
·
Updated
2024-08-21
·
CVE-2023-41333
CVSS v3.1
6.9
Medium
| Vector | AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Cilium versions prior to 1.14.2
Cilium versions prior to 1.13.7
Cilium versions prior to 1.12.14
Description
An attacker with the ability to create or modify CiliumNetworkPolicy objects in a particular namespace can affect traffic on an entire Cilium cluster, potentially bypassing policy enforcement in other namespaces. By using a crafted
endpointSelector that uses the DoesNotExist operator on the reserved:init label, the attacker can create policies that bypass namespace restrictions and affect the entire Cilium cluster, including potentially allowing or denying all traffic. This attack requires API server access.Recommendations
For versions prior to 1.14.2, update to version 1.14.2 or later.
For versions prior to 1.13.7, update to version 1.13.7 or later.
For versions prior to 1.12.14, update to version 1.12.14 or later.
As a temporary workaround, consider using an admission webhook to prevent the use of
endpointSelectors that use the DoesNotExist operator on the reserved:init label in CiliumNetworkPolicies.Exploit
Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cilium