Listen to this Post
How the CVE Works
The vulnerability in Capsule v0.10.3 stems from improper validation in the namespace webhook logic. The system fails to enforce tenant ownership checks when a namespace lacks the `capsule.clastix.io/tenant` label. Attackers can inject arbitrary labels into system namespaces (e.g., kube-system, default), bypassing multi-tenant isolation. By manipulating `TenantResource` selectors, authenticated users can access cross-tenant resources, leading to privilege escalation. The flaw resides in pkg/webhook/namespace/validation/patch.go, where the validation only triggers if the namespace already has a tenant label.
DailyCVE Form
Platform: Kubernetes Capsule
Version: v0.10.3
Vulnerability: Label Injection Bypass
Severity: High
Date: 2024-06-10
Prediction: Patch by 2024-07-15
What Undercode Say
minikube start
helm install capsule projectcapsule/capsule
kubectl patch namespace kube-system --type='json' -p='[{"op":"add","path":"/metadata/labels/malicious-label","value":"attack-value"}]'
How Exploit
1. Authenticate as tenant user.
2. Inject labels into `kube-system`.
3. Create `TenantResource` targeting injected labels.
4. Access cross-tenant resources.
Protection from this CVE
- Apply strict namespace label validation.
- Restrict `TenantResource` selector permissions.
- Update to patched Capsule version.
Impact
- Multi-tenant isolation bypass.
- Privilege escalation.
- Cross-tenant data access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
