CVE-2024-33398

Published: May 3, 2024Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

There is a ClusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, which allows an attacker to impersonate the service account bound to this ClusterRole and use its high-risk privileges to list confidential information across the cluster.

Related CWEs

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (8)

https://gist.github.com/HouqiyuA/d0c11fae5ba4789946ae33175d0f9edb

Source: cve@mitre.org

https://github.com/HouqiyuA/k8s-rbac-poc

Source: cve@mitre.org

https://github.com/piraeusdatastore/piraeus-operator

Source: cve@mitre.org

https://piraeus.io/

Source: cve@mitre.org

https://gist.github.com/HouqiyuA/d0c11fae5ba4789946ae33175d0f9edb

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/HouqiyuA/k8s-rbac-poc

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/piraeusdatastore/piraeus-operator

Source: af854a3a-2127-422b-91ae-364da2661108

https://piraeus.io/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.