Skip to main content

Incorrect Permission Assignment for Critical Resource

CVE-2024-45041

High
8.8/10

Summary

External Secrets Operator is a Kubernetes operator that integrates with external secret management systems. The "external-secrets" deployment, called "default-external-secrets-cert-controller," is associated with a "ClusterRole" of the same name. This "ClusterRole" has "get/list" permissions for secrets resources and "patch/update" permissions for "validatingwebhookconfigurations" resources. An attacker could potentially exploit this by abusing the service account token of the deployment to retrieve all secrets in the cluster, log all data from requests attempting to update secrets, or configure a webhook to deny all pod creation and update requests. This vulnerability affects github.com/external-secrets/external-secrets versions prior to 0.10.2.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-732 - Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References

Advisory Timeline

  • Published