{"id":"GHSA-qwgc-rr35-h4x9","summary":"External Secrets Operator vulnerable to privilege escalation","details":"### Details\nThe external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has \"get/list\" verbs of secrets resources(https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49). It also has path/update verb of validatingwebhookconfigurations resources(https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27). As a result, if a malicious user can access the worker node which has this deployment. he/she can:\n1. For the \"get/list secrets\" permission, he/she can abuse the SA token of this deployment to retrieve or get ALL secrets in the whole cluster, including the cluster-admin secret if created. After that, he/she can abuse the cluster-admin secret to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation.\n\n2. For the patch/update verb of validatingwebhookconfigurations, the malicious user can abuse these permissions to get sensitive data or lanuch DoS attacks:\n\nFor the privilege escalation attack, by updating/patching a Webhook to make it listen to Secret update operations, the attacker can capture and log all data from requests attempting to update Secrets. More specifically, when a Secret is updated, this Webhook sends the request data to the logging-service, which can then log the content of the Secret. This way, an attacker could indirectly gain access to the full contents of the Secret.\n\nFor the DoS attack, by updating/patching a Webhook, and making it deny all Pod create and update requests, the attacker can prevent any new Pods from being created or existing Pods from being updated, resulting in a Denial of Service (DoS) attack.\n\n### PoC\nPlease see the \"Details\" section\n\n### Impact\nPrivilege escalation","aliases":["CVE-2024-45041","GO-2024-3126"],"modified":"2024-09-18T18:44:47Z","published":"2024-09-09T18:16:22Z","database_specific":{"cwe_ids":["CWE-269","CWE-732"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2024-09-09T18:16:22Z","nvd_published_at":"2024-09-09T15:15:11Z"},"references":[{"type":"WEB","url":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-qwgc-rr35-h4x9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45041"},{"type":"WEB","url":"https://github.com/external-secrets/external-secrets/commit/0368b9806f660fa6bc52cbbf3c6ccdb27c58bb35"},{"type":"WEB","url":"https://github.com/external-secrets/external-secrets/commit/428a452fd2ad45935312f2c2c0d40bc37ce6e67c"},{"type":"PACKAGE","url":"https://github.com/external-secrets/external-secrets"},{"type":"WEB","url":"https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27"},{"type":"WEB","url":"https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2024-3126"}],"affected":[{"package":{"name":"github.com/external-secrets/external-secrets","ecosystem":"Go","purl":"pkg:golang/github.com/external-secrets/external-secrets"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.10.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-qwgc-rr35-h4x9/GHSA-qwgc-rr35-h4x9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"}]}