Listen to this Post
How the Vulnerability Works:
The vulnerability resides within KEDA’s TriggerAuthentication resource when configured for HashiCorp Vault authentication. Specifically, the `spec.hashiCorpVault.credential.serviceAccount` field allows specification of a file path for the service account token. The KEDA operator insufficiently validates this user-supplied path before reading the file. An attacker with permissions to create or modify a TriggerAuthentication resource can set this path to any arbitrary location on the node’s filesystem where the KEDA operator pod is running. During the Vault authentication flow, the KEDA operator reads the content of the specified file and incorporates it into the authentication request sent to a Vault server. By configuring a malicious Vault server address under their control, the attacker can intercept this request and exfiltrate the file’s contents. This bypasses intended restrictions because the path is not confined to the standard service account token directory (e.g., /var/run/secrets/kubernetes.io/serviceaccount). Consequently, sensitive system files like /etc/passwd, Kubernetes secrets, or private keys can be read and stolen, leading to potential node and cluster compromise. The core issue is the lack of sanitization that allows directory traversal or absolute path references.
DailyCVE Form:
Platform: KEDA
Version: <2.17.3, <2.18.3
Vulnerability: Arbitrary File Read
Severity: Critical
Date: Unknown
Prediction: Already Patched
What Undercode Say:
Analytics:
`kubectl get deploy keda-operator -n keda -o jsonpath=”{.spec.template.spec.containers[bash].image}”`
Exploit:
Create malicious TriggerAuthentication.
Set arbitrary serviceAccount path.
Configure attacker-controlled Vault address.
Protection from this CVE:
Restrict TriggerAuthentication permissions.
Update to patched versions.
Impact:
Sensitive file exfiltration.
Node/cluster compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
