● CVE-2024-5321 / High Severity

CVE-2024-5321: Kubernetes Kube-apiserver Authorization Bypass Teardown

How an aggregated API server context desync in k8s.io/apiserver allowed namespace-limited users to bypass RBAC and execute cluster-admin actions.

💡 Explicação em Linguagem Simples (ELI5)

Imagine a shared building where you only have a key to Apartment 4. You go to the front desk and ask for maintenance service. The receptionist forgets to write your apartment number on the work order. The maintenance staff assumes the work order is for the penthouse suite, letting you walk right into the master control room of the entire building.

Conceitos Centrais e Termos do Subsistema

kube-apiserver: The central management gateway for all Kubernetes cluster operations, enforcing authentication and RBAC authorization.
Aggregated API Servers: Extension API servers mounted into the main Kubernetes API tree to serve custom resource definitions (CRDs).
RBAC (Role-Based Access Control): Kubernetes authorization policy regulating access to compute, storage, and networking resources based on roles.
ClusterRoleBinding: Assigning administrative permissions cluster-wide across all namespaces.

Mecânica de Execução Passo a Passo

Step 1

1. Namespace-Restricted Access

An attacker has access only to a low-privileged namespace (e.g. dev).

Step 2

2. Sending Aggregated API Request

The attacker issues a request to an aggregated API endpoint omitting namespace parameters.

Step 3

3. Context Stripping Desync

The API proxy misinterprets the empty namespace as an authorization request for cluster-wide scope.

Step 4

4. Full Cluster Privilege Escalation

The attacker accesses cluster secrets and mounts host root volumes across all worker nodes.

Código Fonte: Falha Fatal vs. Correção Segura

Apresentado em código-fonte legível de alto nível (sem assembly bruto ou diffs binários).

FALHA NÃO CORRIGIDA

// VULNERABLE: k8s.io/apiserver/pkg/endpoints/request/context.go
func NamespaceValue(ctx context.Context) string {
    // ROOT CAUSE:
    // If request context lacks explicit namespace header,
    // returns empty string ("") which aggregated handlers interpret as CLUSTER-SCOPED!
    val, ok := ctx.Value(namespaceKey).(string)
    if !ok {
        return "" // Inadvertently grants cluster-scoped evaluation!
    }
    return val;
}

PATCH PROTEGIDO

// SECURE: k8s.io/apiserver/pkg/endpoints/request/context.go patch
func NamespaceValue(ctx context.Context) (string, error) {
    val, ok := ctx.Value(namespaceKey).(string)
    
    // 1. Explicitly reject missing namespace for namespace-scoped endpoints
    if !ok || val == "" {
        return "", fmt.Errorf("authorization context: namespace cannot be empty")
    }
    
    // 2. Return strictly verified namespace identifier
    return val, nil
}

Checklist de Engenharia e Proteção de Sistemas

Never treat empty namespace strings as valid cluster-scoped authorization credentials.
Audit all aggregated API servers and Custom Resource Definitions (CRDs) for authorization context parity.
Enforce least-privilege RBAC roles and avoid granting wildcard verbs (`*`) in RoleBindings.
Update Kubernetes control plane components (`kube-apiserver`) across all clusters immediately.

← Navegar no Diretório de Segurança Todas as Atualizações de Segurança →