PT-2024-29587 · Kubean · Kubean

Younaman · Published 2024-08-05 · Updated 2024-08-06 · CVE-2024-41820

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kubean versions prior to 0.18.0

Description The issue concerns a cluster lifecycle management toolchain where the ClusterRole has excessive permissions, allowing a malicious user to abuse these permissions and perform any action on the whole cluster, resulting in a cluster-level privilege escalation. This can occur if the malicious user gains access to the worker node with Kubean's deployment.

Recommendations For versions prior to 0.18.0, upgrade to release version 0.18.0 or later to address the issue. At the moment, there is no information about other workarounds for this issue.

Exploit

Fix

Incorrect Default Permissions

Incorrect Permission

Weakness Enumeration

CWE-276

CWE-732

Related Identifiers

CVE-2024-41820

GHSA-3WFJ-3X8Q-HRPG

GO-2024-3039

Affected Products

Kubean

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41820.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-41820 · Security Note
• https://osv.dev/vulnerability/GO-2024-3039 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41820 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3wfj-3x8q-hrpg · Vendor Advisory
• https://github.com/kubean-io/kubean · Note
• https://github.com/kubean-io/kubean/security/advisories/GHSA-3wfj-3x8q-hrpg · Note
• https://github.com/kubean-io/kubean/commit/167e97329e4a27ba2f456d2846d39af20e1af7ef · Note
• https://github.com/kubean-io/kubean/issues/1326 · Note
• https://t.me/cvedetector/2491 · Telegram Post
• https://pkg.go.dev/vuln/GO-2024-3039 · Note