Listen to this Post
How the CVE Works
The vulnerability in External Secrets Operator (v0.15.0–v0.19.1) stems from missing namespace restrictions in `List()` calls for Kubernetes `Secret` and `SecretStore` resources. Attackers with `PushSecret` creation/update permissions and control over `SecretStore` configurations could abuse label selectors to retrieve secrets cluster-wide, bypassing namespace isolation. The flaw allows unauthorized access to sensitive data like credentials and tokens stored in any namespace.
DailyCVE Form
Platform: Kubernetes
Version: v0.15.0–v0.19.1
Vulnerability: Namespace bypass
Severity: Critical
Date: 2024-XX-XX
Prediction: Patch by Q2 2024
What Undercode Say
kubectl get secrets --all-namespaces -l key=value kubectl audit pushsecrets --cluster
How Exploit
1. Attacker creates malicious `PushSecret`.
2. Uses label selectors in `SecretStore`.
3. Exfiltrates cross-namespace secrets.
Protection from this CVE
- Upgrade to v0.19.2+.
- Restrict `PushSecret` RBAC.
- Audit `SecretStore` controls.
Impact
- Full secret disclosure.
- Cluster-wide credential theft.
- Privilege escalation risks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
