HouqiyuA/gist:0de688e6b874e480ddc1154350368450 Secret

## gistfile1.txt
[Description]:
Insecure permissions in hwameistor v0.14.3 and earlier versions allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

[Vulnerability Type]:
Incorrect Access Control

[Vendor of Product]:
https://github.com/hwameistor/hwameistor

[Affected Product Code Base]:
hwameistor - <=v0.14.3

[Affected Component]:
Directly compromise all Secrets components in k8s, further compromise other components in the cluster or even take over the entire kubernetes cluster.

[Attack Vectors]:
1. the attacker stole the token.
   Here is an example of stealing a token：in cncf, there is a project named hwameistor, and the DaemonSet hwameistor-local-disk-manager for that project has a cluster role named hwameistor-admin, which has the `update/patch` verb of `nodes` resource.If a malicious user takes control of a worker node, by default the "hwameistor-local-disk-manager" pod will run on that node and he/she can use that pod to patch/update other nodes and force hwameistor’s pod to run on the malicious worker node. Then, he/she can stole the token.
2. Use the obtained token information to authenticate with the API Server. By including the token in the request, attacker can be recognized as a legitimate user with the ServiceAccount and gain all privileges associated with the ServiceAccount.
3. Use the privileges to access all Secrets in the cluster.
4. Use the sensitive information in the Secrets to elevate privileges and explore other sensitive resources, and eventually take over the entire cluster.
[PoC]:
https://github.com/HouqiyuA/k8s-rbac-poc
	[Description]:
	Insecure permissions in hwameistor v0.14.3 and earlier versions allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

	[Vulnerability Type]:
	Incorrect Access Control

	[Vendor of Product]:
	https://github.com/hwameistor/hwameistor

	[Affected Product Code Base]:
	hwameistor - <=v0.14.3

	[Affected Component]:
	Directly compromise all Secrets components in k8s, further compromise other components in the cluster or even take over the entire kubernetes cluster.

	[Attack Vectors]:
	1. the attacker stole the token.
	Here is an example of stealing a token：in cncf, there is a project named hwameistor, and the DaemonSet hwameistor-local-disk-manager for that project has a cluster role named hwameistor-admin, which has the `update/patch` verb of `nodes` resource.If a malicious user takes control of a worker node, by default the "hwameistor-local-disk-manager" pod will run on that node and he/she can use that pod to patch/update other nodes and force hwameistor’s pod to run on the malicious worker node. Then, he/she can stole the token.
	2. Use the obtained token information to authenticate with the API Server. By including the token in the request, attacker can be recognized as a legitimate user with the ServiceAccount and gain all privileges associated with the ServiceAccount.
	3. Use the privileges to access all Secrets in the cluster.
	4. Use the sensitive information in the Secrets to elevate privileges and explore other sensitive resources, and eventually take over the entire cluster.
	[PoC]:
	https://github.com/HouqiyuA/k8s-rbac-poc