Listen to this Post
The vulnerability in Kgateway stems from an insecure implementation of its transformation policy template feature. Users authorized to create TrafficPolicy objects can craft malicious transformation templates. These templates leverage the underlying Envoy filter’s ability to process files from the local filesystem. By specifying a malicious template, an attacker can manipulate the dataplane container into reading arbitrary files, the contents of which are then included in the HTTP response sent back to the client. This effectively bypasses any intended access controls and exposes the contents of any file that the dataplane container’s process has permission to read, leading to a critical information disclosure vulnerability.
Platform: Kgateway
Version: <=2.0.4
Vulnerability: Arbitrary File Read
Severity: Critical
date: 2024
Prediction: Patch Available
What Undercode Say:
curl -X POST $KGATEWAY/admin/policies -H "Content-Type: application/yaml" --data-binary @- <<EOF
apiVersion: gateway.solo.io/v1
kind: TrafficPolicy
metadata:
name: malicious-transform
spec:
targetRef:
name: example-service
transformation:
templates:
passthrough: {}
body:
inlineString: |
{{(printf "File: %s" (.body | b64dec)) | b64enc}}
EOF
local file_content = os.getenv("SENSITIVE_FILE_PATH")
-- Content is then embedded into an HTTP response.
How Exploit:
Craft malicious transformation template.
Policy applies file read.
Sensitive data exfiltrated.
Protection from this CVE
Upgrade to v2.0.5.
Use ValidatingAdmissionPolicy.
Restrict TrafficPolicy permissions.
Impact:
Configuration file exposure.
Custom volume data leak.
Information disclosure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
