Vulnerability · Published May 6, 2022 · Assigned by GitHub_M
CVE-2022-24817Improper kubeconfig validation allows arbitrary code execution
Critical 9.9
In plain English
A critical-severity code injection in flux2 from fluxcd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/fluxcd/flux2 | 0.29.0 | GHSA-vvmq-fwmg-2gjc |
| Go | github.com/fluxcd/helm-controller | 0.19.0 | GHSA-vvmq-fwmg-2gjc |
| Go | github.com/fluxcd/kustomize-controller | 0.23.0 | GHSA-vvmq-fwmg-2gjc |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/fluxcd/flux2/security/advisories/GHSA-vvmq-fwmg-2gjc x_refsource_CONFIRM