CVE-2023-29018 OpenFeature Operator vulnerable to Cluster-level Privilege Escalation
An attacker with code execution can escalate privileges via lax operator permissions to modify cluster state or read secrets.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-29018?
CVE-2023-29018 is a high-severity vulnerability in open-feature-operator, published on 14 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on `open-feature-operator-controller-manager` to escalate the privileges of any SA in the cluster. The increased privileges could be used to modify cluster state, leading to DoS, or read sensitive data, including secrets. Version 0.2.32 mitigates this issue by restricting the resources the `open-feature-operator-controller-manager` can modify.
Weakness: CWE-269
Which versions are affected by CVE-2023-29018?
3 open source packages ship an affected version, including github.com/open-feature/open-feature-operator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/open-feature/open-feature-operator Go | All versions | 0.2.32 |
github.com/open-feature/open-feature-operator Go | All versions | 0.2.32 |
github.com/open-feature/open-feature-operator Go | All versions | 0.2.32 |
Products include Linuxfoundation Openfeature.
How do I fix CVE-2023-29018?
Upgrade github.com/open-feature/open-feature-operator to 0.2.32 or later.
Is CVE-2023-29018 being exploited?
There is no known exploitation of CVE-2023-29018 in the wild and no public exploit code.
Sources
Also known as GHSA-cwf6-xj49-wp83, GO-2023-1721.