CVE-2024-45041: external-secrets external_secrets_operator Improper Privilege Management

Vulnerability summary

CVE-2024-45041 is a high (CVSS 8.8) Improper Privilege Management vulnerability in external-secrets external_secrets_operator. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 47.5% of scored vulnerabilities.

Timeline

1. 09-09-2024
   PublishedVulnerability first disclosed.
2. 09-09-2024
   Last modifiedVulnerability information updated.

Description

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It also has path/update verb of validatingwebhookconfigurations resources. This can be used to abuse the SA token of the deployment to retrieve or get ALL secrets in the whole cluster, capture and log all data from requests attempting to update Secrets, or make a webhook deny all Pod create and update requests. This vulnerability is fixed in 0.10.2.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.