● CVE-2024-5321 / High Severity

CVE-2024-5321: Kubernetes Kube-apiserver Authorization Bypass Teardown

How an aggregated API server context desync in k8s.io/apiserver allowed namespace-limited users to bypass RBAC and execute cluster-admin actions.

💡 Простое объяснение на пальцах (ELI5)

Imagine a shared building where you only have a key to Apartment 4. You go to the front desk and ask for maintenance service. The receptionist forgets to write your apartment number on the work order. The maintenance staff assumes the work order is for the penthouse suite, letting you walk right into the master control room of the entire building.

Ключевые концепции и архитектурные термины

kube-apiserver: The central management gateway for all Kubernetes cluster operations, enforcing authentication and RBAC authorization.
Aggregated API Servers: Extension API servers mounted into the main Kubernetes API tree to serve custom resource definitions (CRDs).
RBAC (Role-Based Access Control): Kubernetes authorization policy regulating access to compute, storage, and networking resources based on roles.
ClusterRoleBinding: Assigning administrative permissions cluster-wide across all namespaces.

Пошаговая механика выполнения атаки

Step 1

1. Namespace-Restricted Access

An attacker has access only to a low-privileged namespace (e.g. dev).

Step 2

2. Sending Aggregated API Request

The attacker issues a request to an aggregated API endpoint omitting namespace parameters.

Step 3

3. Context Stripping Desync

The API proxy misinterprets the empty namespace as an authorization request for cluster-wide scope.

Step 4

4. Full Cluster Privilege Escalation

The attacker accesses cluster secrets and mounts host root volumes across all worker nodes.

Исходный код: Уязвимость vs. Исправленный патч

Представлено на понятном высокоуровневом исходном коде (без ассемблера и бинарных дампов).

УЯЗВИМЫЙ КОД ДО ПАТЧА

// VULNERABLE: k8s.io/apiserver/pkg/endpoints/request/context.go
func NamespaceValue(ctx context.Context) string {
    // ROOT CAUSE:
    // If request context lacks explicit namespace header,
    // returns empty string ("") which aggregated handlers interpret as CLUSTER-SCOPED!
    val, ok := ctx.Value(namespaceKey).(string)
    if !ok {
        return "" // Inadvertently grants cluster-scoped evaluation!
    }
    return val;
}

БЕЗОПАСНОЕ ИСПРАВЛЕНИЕ

// SECURE: k8s.io/apiserver/pkg/endpoints/request/context.go patch
func NamespaceValue(ctx context.Context) (string, error) {
    val, ok := ctx.Value(namespaceKey).(string)
    
    // 1. Explicitly reject missing namespace for namespace-scoped endpoints
    if !ok || val == "" {
        return "", fmt.Errorf("authorization context: namespace cannot be empty")
    }
    
    // 2. Return strictly verified namespace identifier
    return val, nil
}

Инженерный чек-лист для код-ревью и защиты систем

Never treat empty namespace strings as valid cluster-scoped authorization credentials.
Audit all aggregated API servers and Custom Resource Definitions (CRDs) for authorization context parity.
Enforce least-privilege RBAC roles and avoid granting wildcard verbs (`*`) in RoleBindings.
Update Kubernetes control plane components (`kube-apiserver`) across all clusters immediately.

← Полный каталог уязвимостей Все бюллетени безопасности →