Vulnerability · Published Aug 12, 2024 · Assigned by GitHub_M
CVE-2024-42480Kamaji's RBAC Roles for `etcd` are not disjunct
High 8.1
In plain English
A high-severity improper access control in kamaji from clastix. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 50.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed in edge-24.8.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/clastix/kamaji | no fix listed | GHSA-6r4j-4rjc-8vw5 |
| Go | github.com/clastix/kamaji | no fix listed | GO-2024-3063 |
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/clastix/kamaji/security/advisories/GHSA-6r4j-4rjc-8vw5 x_refsource_CONFIRM
- https://github.com/clastix/kamaji/commit/1731e8c2ed5148b125ecfbdf091ee177bd44f3db x_refsource_MISC
- https://github.com/clastix/kamaji/blob/8cdc6191242f80d120c46b166e2102d27568225a/internal/datastore/etcd.go#L19-L24 x_refsource_MISC