CVE-2020-8567 Kubernetes Secrets Store CSI Driver plugin directory traversals
Attackers can write to arbitrary host files via crafted SecretProviderClass objects in Kubernetes Secrets Store CSI Driver plugins.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8567?
CVE-2020-8567 is a medium-severity path traversal vulnerability in Kubernetes Secrets Store CSI Driver, published on 21 Jan 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
Which versions are affected by CVE-2020-8567?
9 open source packages ship an affected version, including github.com/Azure/secrets-store-csi-driver-provider-azure, github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp and github.com/hashicorp/vault-csi-provider. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/Azure/secrets-store-csi-driver-provider-azure Go | All versions | None |
github.com/Azure/secrets-store-csi-driver-provider-azure Go | All versions | 0.0.10 |
github.com/Azure/secrets-store-csi-driver-provider-azure Go | All versions | 0.0.10 |
github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp Go | All versions | 0.2.0 |
github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp Go | All versions | 0.2.0 |
github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp Go | All versions | 0.2.0 |
3 more packages
github.com/hashicorp/vault-csi-provider Go | All versions | None |
github.com/hashicorp/vault-csi-provider Go | All versions | 0.0.6 |
github.com/hashicorp/vault-csi-provider Go | All versions | 0.0.6 |
Products include Google Secret Manager Provider for Secret Store Csi Driver, Hashicorp Vault Provider for Secrets Store Csi Driver, Microsoft Azure Key Vault Provider for Secrets Store Csi Driver.
How do I fix CVE-2020-8567?
Upgrade github.com/Azure/secrets-store-csi-driver-provider-azure to 0.0.10 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-8567 being exploited?
There is no known exploitation of CVE-2020-8567 in the wild and no public exploit code.
Sources
Also known as GHSA-2v35-wj4r-rcmv, GO-2024-2750.