PT-2024-31406 · Unknown · Hwameistor

Younaman · Published 2024-08-28 · Updated 2024-09-12 · CVE-2024-45054

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hwameistor versions prior to 0.14.6

Description Hwameistor is a high-availability local storage system for cloud-native stateful workloads. This ClusterRole has excessive permissions, allowing a malicious user who can access the worker node with Hwameistor's deployment to abuse these permissions and perform any actions on the whole cluster, resulting in a cluster-level privilege escalation.

Recommendations For versions prior to 0.14.6, upgrade to version 0.14.6 or later. For users unable to upgrade, update and limit the ClusterRole using security-role as a temporary workaround.

Exploit

Fix

Incorrect Privilege Assignment

Information Disclosure

Weakness Enumeration

CWE-266

CWE-200

Related Identifiers

CVE-2024-45054

GHSA-MGWR-H7MV-FH29

GO-2024-3103

Affected Products

Hwameistor

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45054.json · Exploit
• https://github.com/hwameistor/hwameistor/commit/edf4cebed73cadd230bf97eab65c5311f2858450 · Patch
• https://github.com/hwameistor/hwameistor/security/advisories/GHSA-mgwr-h7mv-fh29 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45054 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mgwr-h7mv-fh29 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3103 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45054 · Security Note
• https://github.com/hwameistor/hwameistor · Note
• https://github.com/hwameistor/hwameistor/blob/main/helm/hwameistor/templates/clusterrole.yaml · Note
• https://github.com/hwameistor/hwameistor/issues/1457 · Note
• https://github.com/hwameistor/hwameistor/issues/1460 · Note
• https://twitter.com/CVEnew/status/1828889463054819362 · Twitter Post
• https://t.me/cvedetector/4350 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1828929908648640914 · Twitter Post