HouqiyuA/gist:d0c11fae5ba4789946ae33175d0f9edb Secret

## gistfile1.txt
[Description]:
There is a clusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, This means that he can get all secrets in the cluster. Granting this privilege is excessive and does not follow the principle of least privilege ,which allows attacker impersonate the service account bound to this ClusterRole and use its high-risk privileges to list confidential information across the cluster. By this way, attacker could elevate the privileges and further take over the entire cluster.


[Vulnerability Type]:
Incorrect Access Control

[Vendor of Product]:
https://github.com/piraeusdatastore/piraeus-operator

[Affected Product Code Base]:
piraeus-operator<=v2.5.0

[Affected Component]:
Directly compromise all Secrets components in k8s, further compromise other components in the cluster or even take over the entire kubernetes cluster.

[Attack Vectors]:

1. the attacker stole the token.
   Here is an example of stealing a token：in cncf, there is a project named hwameistor, and the DaemonSet hwameistor-local-disk-manager for that project has a cluster role named hwameistor-admin, which has the `update/patch` verb of `nodes` resource.If a malicious user takes control of a worker node, by default the "hwameistor-local-disk-manager" pod will run on that node and he/she can use that pod to patch/update other nodes and force piraeus-operator’s pod to run on the malicious worker node. Then, he/she can stole the token.
2. Use the obtained token information to authenticate with the API Server. By including the token in the request, attacker can be recognized as a legitimate user with the ServiceAccount and gain all privileges associated with the ServiceAccount.
3. Use the privileges to access all Secrets in the cluster.
4. Use the sensitive information in the Secrets to elevate privileges and explore other sensitive resources, and eventually take over the entire cluster.
	[Description]:
	There is a clusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, This means that he can get all secrets in the cluster. Granting this privilege is excessive and does not follow the principle of least privilege ,which allows attacker impersonate the service account bound to this ClusterRole and use its high-risk privileges to list confidential information across the cluster. By this way, attacker could elevate the privileges and further take over the entire cluster.


	[Vulnerability Type]:
	Incorrect Access Control

	[Vendor of Product]:
	https://github.com/piraeusdatastore/piraeus-operator

	[Affected Product Code Base]:
	piraeus-operator<=v2.5.0

	[Affected Component]:
	Directly compromise all Secrets components in k8s, further compromise other components in the cluster or even take over the entire kubernetes cluster.

	[Attack Vectors]:

	1. the attacker stole the token.
	Here is an example of stealing a token：in cncf, there is a project named hwameistor, and the DaemonSet hwameistor-local-disk-manager for that project has a cluster role named hwameistor-admin, which has the `update/patch` verb of `nodes` resource.If a malicious user takes control of a worker node, by default the "hwameistor-local-disk-manager" pod will run on that node and he/she can use that pod to patch/update other nodes and force piraeus-operator’s pod to run on the malicious worker node. Then, he/she can stole the token.
	2. Use the obtained token information to authenticate with the API Server. By including the token in the request, attacker can be recognized as a legitimate user with the ServiceAccount and gain all privileges associated with the ServiceAccount.
	3. Use the privileges to access all Secrets in the cluster.
	4. Use the sensitive information in the Secrets to elevate privileges and explore other sensitive resources, and eventually take over the entire cluster.