Listen to this Post
How the mentioned CVE works:
The Flux Operator Web UI uses OIDC tokens for user authentication. Token claims like `email` and `groups` are processed through CEL expressions to derive a Kubernetes username and group list for RBAC impersonation. The vulnerability exists because there is no validation to ensure the resulting `username` and `groups` values from these expressions are non-empty. If the configured OIDC provider issues tokens lacking these claims, or if custom CEL expressions evaluate to empty strings/arrays, both values become empty. When the Kubernetes client-go library creates an API client with empty impersonation configuration, it omits the impersonation headers entirely. This causes all subsequent Kubernetes API requests to be executed using the high-privileged `flux-operator` service account’s credentials instead of the authenticated user’s limited identity, leading to a privilege escalation.
DailyCVE Form:
Platform: Flux Operator
Version: Pre v0.40.0
Vulnerability: RBAC Impersonation Bypass
Severity: High
Date: 2024-05-23
Prediction: Patch Released (v0.40.0)
What Undercode Say:
Check Flux Operator version
kubectl get deployment -n flux-system flux-operator -o jsonpath='{.spec.template.spec.containers[bash].image}'
Apply patched version v0.40.0
kubectl set image deployment/flux-operator -n flux-system flux-operator=ghcr.io/fluxcd/flux-operator:v0.40.0
Vulnerable impersonation config example (missing validation) impersonation: username: has(claims.email) ? claims.email : '' groups: has(claims.groups) ? claims.groups : []
How Exploit:
- Prerequisite: OIDC provider missing
email/groupsclaims. - User authenticates with valid OIDC token.
- CEL expressions evaluate to empty “” and [].
- API requests execute as `flux-operator` service account.
- Attacker gains cluster-wide read and control actions.
Protection from this CVE:
- Immediate upgrade to v0.40.0.
- Enforce non-empty claim values in OIDC config.
- Modify CEL expressions to reject empty results.
- Implement validation for impersonation parameters.
Impact:
- Privilege Escalation to operator-level.
- Unauthorized read access cluster-wide.
- Sensitive GitOps configuration disclosure.
- Bypass of all RBAC restrictions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
