Improper Control of Generation of Code ('Code Injection')
CVE-2022-24817
Summary
Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions 0.1.0 through 0.28.5, helm-controller versions 0.1.0 through v0.18.2, and kustomize-controller versions 0.1.0 through v0.22.3 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments, this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the 'spec.kubeConfig' field in Flux 'Kustomization' and 'HelmRelease' objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0, helm-controller v0.19.0, and flux2 v0.29.0.
- LOW
- NETWORK
- HIGH
- CHANGED
- NONE
- LOW
- HIGH
- HIGH
CWE-94 - Code Injection
Code injection is a type of vulnerability that allows an attacker to execute arbitrary code. This vulnerability fully compromises the machine and can cause a wide variety of security issues, such as unauthorized access to sensitive information, manipulation of data, denial of service attacks etc. Code injection is different from command injection in the fact that it is limited by the functionality of the injected language (e.g. PHP), as opposed to command injection, which leverages existing code to execute commands, usually within the context of a shell.
Advisory Timeline
- Published
