HouqiyuA/gist:1cb964206e0d6bebd1c57a124c55fa03 Secret

## gistfile1.txt
[Description]:
Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges.[Vulnerability Type]:
Incorrect Access Control

[Vendor of Product]:
https://github.com/kubeslice/kubeslice

[Affected Product Code Base]:
kubeslice - <=v1.3.1

[Affected Component]:
Directly compromise all Secrets components in k8s, further compromise other components in the cluster or even take over the entire kubernetes cluster.
[Attack Vectors]:
1. Malicious users steal the ServiceAccount'token.
  An example:in cncf, there is a project named hwameistor, and the DaemonSet hwameistor-local-disk-manager for that project has a clusterrole named hwameistor-admin, which has update/patch verb of nodes resource.If a malicious user takes control of a worker node, by default the "hwameistor-local-disk-manager" pod will run on that node and he/she can use that pod to patch/update other nodes and force the kubeslice   s   pod with excessive permissions  to run on the malicious worker node.Then, he/she can stole the token.
2. Use the obtained token information to authenticate with the API Server. By including the token in the request, attacker can be recognized as a legitimate user with the ServiceAccount and gain all privileges associated with the ServiceAccount.
3. Use the privileges to access all Secrets in the cluster.
4. Use the sensitive information in the Secrets to elevate privileges even take over the cluster
	[Description]:
	Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges.[Vulnerability Type]:
	Incorrect Access Control

	[Vendor of Product]:
	https://github.com/kubeslice/kubeslice

	[Affected Product Code Base]:
	kubeslice - <=v1.3.1

	[Affected Component]:
	Directly compromise all Secrets components in k8s, further compromise other components in the cluster or even take over the entire kubernetes cluster.
	[Attack Vectors]:
	1. Malicious users steal the ServiceAccount'token.
	An example:in cncf, there is a project named hwameistor, and the DaemonSet hwameistor-local-disk-manager for that project has a clusterrole named hwameistor-admin, which has update/patch verb of nodes resource.If a malicious user takes control of a worker node, by default the "hwameistor-local-disk-manager" pod will run on that node and he/she can use that pod to patch/update other nodes and force the kubeslice s pod with excessive permissions to run on the malicious worker node.Then, he/she can stole the token.
	2. Use the obtained token information to authenticate with the API Server. By including the token in the request, attacker can be recognized as a legitimate user with the ServiceAccount and gain all privileges associated with the ServiceAccount.
	3. Use the privileges to access all Secrets in the cluster.
	4. Use the sensitive information in the Secrets to elevate privileges even take over the cluster