CVE-2022-24877 Improper path handling in kustomization files allows path traversal
Attackers can exploit path traversal in kustomization files to read sensitive data from the controller pod and potentially escalate privileges in multi-tenant environments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24877?
CVE-2022-24877 is a critical path traversal vulnerability in fluxcd flux2, published on 6 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.
Which versions are affected by CVE-2022-24877?
8 open source packages ship an affected version, including github.com/fluxcd/flux2, flux and kustomize. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/fluxcd/flux2 Go | All versions | 0.29.0 |
github.com/fluxcd/flux2 Go | All versions | 0.29.0 |
github.com/fluxcd/flux2 Go | All versions | 0.29.0 |
flux Bitnami | All versions | 0.29.0 |
kustomize Bitnami | All versions | 0.24.0 |
github.com/fluxcd/kustomize-controller Go | All versions | 0.24.0 |
2 more packages
github.com/fluxcd/kustomize-controller Go | All versions | 0.24.0 |
github.com/fluxcd/kustomize-controller Go | All versions | 0.24.0 |
Products include Fluxcd Flux2, Fluxcd Kustomize-Controller.
How do I fix CVE-2022-24877?
Upgrade github.com/fluxcd/flux2 to 0.29.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-24877 being exploited?
There is no known exploitation of CVE-2022-24877 in the wild and no public exploit code.
Other vulnerabilities in fluxcd flux2
- CVE-2022-24817 Improper kubeconfig validation allows arbitrary code execution
- CVE-2022-36049 Flux2 Helm Controller denial of service
- CVE-2022-36035 Flux CLI Workload Injection
- CVE-2022-24878 Improper path handling in Kustomization files allows for denial of service
- CVE-2022-39272 Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration
Sources
Also known as BIT-flux-2022-24877, BIT-kustomize-2022-24877, GHSA-j77r-2fxf-5jrw, GO-2022-0447.