Skip to content

Instantly share code, notes, and snippets.

@HouqiyuA
Last active June 20, 2024 11:17
Show Gist options
  • Save HouqiyuA/43488e1d41110a5610146b87b2e88a02 to your computer and use it in GitHub Desktop.
Save HouqiyuA/43488e1d41110a5610146b87b2e88a02 to your computer and use it in GitHub Desktop.
CVE-2024-36532 References
[Description]:
Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
[Vulnerability Type]:
Incorrect Access Control
[Vendor of Product]:
https://github.com/openkruise/kruise
[Affected Product Code Base]:
kruise v1.6.2
[Affected Component]:
Directly compromise all Secrets components in k8s, further compromise other components in the cluster or even take over the entire kubernetes cluster.
[Attack Vectors]:
1. the attacker stole the token.
Here is an example of stealing a token:in cncf, there is a project named hwameistor, and the DaemonSet hwameistor-local-disk-manager for that project has a cluster role named hwameistor-admin, which has the `update/patch` verb of `nodes` resource.If a malicious user takes control of a worker node, by default the "hwameistor-local-disk-manager" pod will run on that node and he/she can use that pod to patch/update other nodes and force kruise’s pod to run on the malicious worker node. Then, he/she can stole the token.
2. Use the obtained token information to authenticate with the API Server. By including the token in the request, attacker can be recognized as a legitimate user with the ServiceAccount and gain all privileges associated with the ServiceAccount.
3. Use the privileges to access all Secrets in the cluster.
4. Use the sensitive information in the Secrets to elevate privileges and explore other sensitive resources, and eventually take over the entire cluster.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment