● CVE-2024-5321 / High Severity

CVE-2024-5321: Kubernetes Kube-apiserver Authorization Bypass Teardown

How an aggregated API server context desync in k8s.io/apiserver allowed namespace-limited users to bypass RBAC and execute cluster-admin actions.

💡 Explication en Termes Simples (ELI5)

Imagine a shared building where you only have a key to Apartment 4. You go to the front desk and ask for maintenance service. The receptionist forgets to write your apartment number on the work order. The maintenance staff assumes the work order is for the penthouse suite, letting you walk right into the master control room of the entire building.

Concepts Clés et Termes du Sous-système

kube-apiserver: The central management gateway for all Kubernetes cluster operations, enforcing authentication and RBAC authorization.
Aggregated API Servers: Extension API servers mounted into the main Kubernetes API tree to serve custom resource definitions (CRDs).
RBAC (Role-Based Access Control): Kubernetes authorization policy regulating access to compute, storage, and networking resources based on roles.
ClusterRoleBinding: Assigning administrative permissions cluster-wide across all namespaces.

Mécanique d'Exécution Étape par Étape

Step 1

1. Namespace-Restricted Access

An attacker has access only to a low-privileged namespace (e.g. dev).

Step 2

2. Sending Aggregated API Request

The attacker issues a request to an aggregated API endpoint omitting namespace parameters.

Step 3

3. Context Stripping Desync

The API proxy misinterprets the empty namespace as an authorization request for cluster-wide scope.

Step 4

4. Full Cluster Privilege Escalation

The attacker accesses cluster secrets and mounts host root volumes across all worker nodes.

Code Source : Faille Critique vs. Correctif Sécurisé

Fourni en code source de haut niveau lisible (sans assembleur brut ni diff binaire).

FAILLE NON CORRIGÉE

// VULNERABLE: k8s.io/apiserver/pkg/endpoints/request/context.go
func NamespaceValue(ctx context.Context) string {
    // ROOT CAUSE:
    // If request context lacks explicit namespace header,
    // returns empty string ("") which aggregated handlers interpret as CLUSTER-SCOPED!
    val, ok := ctx.Value(namespaceKey).(string)
    if !ok {
        return "" // Inadvertently grants cluster-scoped evaluation!
    }
    return val;
}

CORRECTIF RENFORCÉ

// SECURE: k8s.io/apiserver/pkg/endpoints/request/context.go patch
func NamespaceValue(ctx context.Context) (string, error) {
    val, ok := ctx.Value(namespaceKey).(string)
    
    // 1. Explicitly reject missing namespace for namespace-scoped endpoints
    if !ok || val == "" {
        return "", fmt.Errorf("authorization context: namespace cannot be empty")
    }
    
    // 2. Return strictly verified namespace identifier
    return val, nil
}

Checklist d'Ingénierie et de Durcissement Système

Never treat empty namespace strings as valid cluster-scoped authorization credentials.
Audit all aggregated API servers and Custom Resource Definitions (CRDs) for authorization context parity.
Enforce least-privilege RBAC roles and avoid granting wildcard verbs (`*`) in RoleBindings.
Update Kubernetes control plane components (`kube-apiserver`) across all clusters immediately.

← Parcourir l'Annuaire de Sécurité Tous les Bulletins de Sécurité →