by Kastro
Paper/Archive/CVE-2024-42480

CVE-2024-42480

clastix kamaji — Kamaji's RBAC Roles for `etcd` are not disjunct

EPSS 0.6%public exploitCVSS 9.9
critical.is priorityof 100
50
CVSS 9.9 (NVD)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 49.8.498 × 2010.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed in edge-24.8.2.

Affected

ProductAffectedFixed inSource
kamaji<= 1.0.0–CNA
kamaji≤ 1.0.0–CISA-ADP

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub_M (CNA)8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/clastix/kamaji/security/advisories/GHSA-6r4j-4rjc-8vw5refgithub.com/clastix/kamaji/commit/1731e8c2ed5148b125ecfbdf091ee177bd44f3dbrefgithub.com/clastix/kamaji/blob/8cdc6191242f80d120c46b166e2102d27568225a/internal/datastore/etcd.go#L19-L24