CVE-2020-8568 Kubernetes Secrets Store CSI Driver sync/rotate directory traversal
Attackers with resource modification rights can write to host filesystem and sync secrets via path traversal in Kubernetes Secrets Store CSI Driver.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8568?
CVE-2020-8568 is a medium-severity path traversal vulnerability in Kubernetes Secrets Store CSI Driver, published on 21 Jan 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.
Which versions are affected by CVE-2020-8568?
3 open source packages ship an affected version, including sigs.k8s.io/secrets-store-csi-driver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sigs.k8s.io/secrets-store-csi-driver Go | From 0.0.15 | 0.0.17 |
sigs.k8s.io/secrets-store-csi-driver Go | From 0.0.15 | 0.0.17 |
sigs.k8s.io/secrets-store-csi-driver Go | From 0.0.15 | 0.0.17 |
Products include Kubernetes Secrets Store Csi Driver.
How do I fix CVE-2020-8568?
Upgrade sigs.k8s.io/secrets-store-csi-driver to 0.0.17 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-8568 being exploited?
There is no known exploitation of CVE-2020-8568 in the wild and no public exploit code.
Sources
Also known as GHSA-5cgx-vhfp-6cf9, GO-2022-0629.