A vulnerability addressed this week in the Kubernetes container orchestration system could allow users to read, modify or delete cluster-wide custom resources.
Tracked as CVE-2019-11247, the security flaw is due to an API server providing access to custom resources via wrong scope. Specifically, users are granted access to a cluster-scoped custom resource if the request is made as if the resource were namespaced.
“Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace,” Kubernetes’ Joel Smith explains.
Due to this vulnerability, a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges).
According to StackRox, clusters that are not using Custom Resource Definitions (CRDs) are not affected by the bug. However, with CRDs being a critical component of many Kubernetes-native projects, many users are likely impacted.
Clusters running without Kubernetes RBAC aren’t impacted either, but not using Kubernetes RBAC creates an even greater risk than this vulnerability does.
“Although CVE-2019-11247 has been assigned a medium-severity CVSS score, it poses an especially serious threat when custom resources are used to manage functionality related to cluster or application security,” StackRox notes.
The second security issue is tracked as CVE-2019-11249 and consists of incomplete fixes for two other vulnerabilities, namely CVE-2019-1002101 and CVE-2019-11246, and kubectl cp potential directory traversal.
“This vulnerability allows a malicious container to cause a file to be created or replaced on the client computer when the client uses the kubectl cp operation. The vulnerability is a client-side defect and requires user interaction to be exploited,” Smith explains.
All users are advised to upgrade all Kubernetes clusters and kubectl clients to a patched version, namely Kubernetes 1.13.9, 1.14.5, and 1.15.2.
Related: Serious Path Traversal Flaw Found in Kubernetes
Related: Critical Privilege Escalation Flaw Patched in Kubernetes