CVE-2023-30617 Leverage the kruise-daemon pod to list all secrets in the entire cluster
An attacker with root access on a node can use kruise-daemon to list all cluster secrets and escalate privileges via service account tokens.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-30617?
CVE-2023-30617 is a medium-severity vulnerability in openkruise kruise, published on 3 Jan 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, the attacker can leverage the "captured" secrets (e.g. the kruise-manager service account token) to gain extra privileges such as pod modification. Versions 1.3.1, 1.4.1, and 1.5.2 fix this issue. A workaround is available. For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege.
Which versions are affected by CVE-2023-30617?
6 open source packages ship an affected version, including github.com/openkruise/kruise. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openkruise/kruise Go | From 0.8.0 | 1.3.1 |
github.com/openkruise/kruise Go | From 0.8.0 | 1.3.1 |
github.com/openkruise/kruise Go | From 1.4.0 | 1.4.1 |
github.com/openkruise/kruise Go | From 1.4.0 | 1.4.1 |
github.com/openkruise/kruise Go | From 1.5.0 | 1.5.2 |
github.com/openkruise/kruise Go | From 1.5.0 | 1.5.2 |
Products include Openkruise Kruise.
How do I fix CVE-2023-30617?
Upgrade github.com/openkruise/kruise to a fixed version for your release line: 1.3.1, 1.4.1 or 1.5.2.
Is CVE-2023-30617 being exploited?
There is no known exploitation of CVE-2023-30617 in the wild and no public exploit code.
Other vulnerabilities in openkruise kruise
Sources
Also known as GHSA-437m-7hj5-9mpw.