PT-2023-3262 · Kubernetes · Secrets-Store-Csi-Driver

Tomer Shaiman + 1 · Published 2023-05-25 · Updated 2024-08-20 · CVE-2023-2878

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions secrets-store-csi-driver versions prior to 1.3.3

Description The issue is related to insufficient protection of registration data in the secrets-store-csi-driver component of Kubernetes. This can allow an attacker to gain unauthorized access to protected information. Specifically, service account tokens are disclosed in logs. The tokens could potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.

Recommendations To mitigate this vulnerability, run secrets-store-csi-driver at log level 0 or 1 via the -v flag. Upgrade to secrets-store-csi-driver version 1.3.3 or later, referring to the documentation for upgrade instructions.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2023-03383

CVE-2023-2878

GHSA-G82W-58JF-GCXX

GO-2023-1793

Affected Products

Secrets-Store-Csi-Driver

References · 17

• 🔥 https://github.com/kubernetes/kubernetes/issues/118419 · Exploit
• https://osv.dev/vulnerability/CVE-2023-2878 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1793 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03383 · Security Note
• https://osv.dev/vulnerability/GHSA-g82w-58jf-gcxx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2878 · Security Note
• https://github.com/kubernetes-sigs/secrets-store-csi-driver/security/advisories/GHSA-g82w-58jf-gcxx · Note
• https://github.com/kubernetes-sigs/secrets-store-csi-driver/releases/tag/v1.3.3 · Note
• https://github.com/kubernetes-sigs/secrets-store-csi-driver · Note
• https://twitter.com/NirmataCloud/status/1790034346469990754 · Twitter Post
• https://t.me/cvenotify/56436 · Telegram Post
• https://t.me/cvenotify/52717 · Telegram Post
• https://twitter.com/NirmataCloud/status/1789309485942551009 · Twitter Post
• https://security.netapp.com/advisory/ntap-20230814-0003 · Note
• https://groups.google.com/g/kubernetes-security-announce/c/5K8ghQHBDdQ/m/Udee6YUgAAAJ · Note