PT-2023-3436 · Sealos · Sealos

Dvkunion · Published 2023-05-26 · Updated 2023-07-07 · CVE-2023-33190

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sealos versions prior to 4.2.1-rc4

Description The issue is related to an improper configuration of role-based access control (RBAC) permissions in Sealos, an open-source cloud operating system distribution based on the Kubernetes kernel. This configuration flaw allows an attacker to obtain cluster control permissions, potentially controlling the entire cluster, hundreds of pods, and other resources within the cluster. The estimated number of potentially affected devices is not specified.

Recommendations For Sealos versions prior to 4.2.1-rc4, upgrade to version 4.2.1-rc4 or later to address the issue. As a temporary workaround, consider restricting access to RBAC permissions to minimize the risk of exploitation. There are no known workarounds for this issue other than upgrading to the fixed version.

Exploit

Fix

Improper Authentication

Incorrect Authorization

Weakness Enumeration

CWE-264

CWE-287

CWE-863

Related Identifiers

BDU:2023-03618

CVE-2023-33190

GHSA-74J8-W7F9-PP62

Affected Products

Sealos

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33190.json · Exploit
• https://github.com/labring/sealos/security/advisories/GHSA-74j8-w7f9-pp62 · Vendor Advisory
• https://github.com/labring/sealos/commit/4cdf52e55666864e5f90ed502e9fc13e18985b7b · Patch
• https://bdu.fstec.ru/vul/2023-03618 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33190 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33190 · Security Note
• https://osv.dev/vulnerability/GHSA-74j8-w7f9-pp62 · Vendor Advisory
• https://github.com/labring/sealos · Note
• https://vuldb.com/ru/?id.232705 · Note
• https://t.me/cvenotify/53342 · Telegram Post
• https://t.me/cvenotify/53391 · Telegram Post