CVE-2023-33190 Improperly configured permissions in Sealos
Attackers can gain cluster control permissions due to improper RBAC configuration, allowing full control over the Sealos cloud operating system and its resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-33190?
CVE-2023-33190 is a critical missing authorization vulnerability in labring sealos, published on 29 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control (RBAC) permissions resulted in an attacker being able to obtain cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. This issue has been addressed in version 4.2.1-rc4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2023-33190?
2 open source packages ship an affected version, including github.com/labring/sealos. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/labring/sealos Go | All versions | 4.2.1-rc4 |
github.com/labring/sealos Go | All versions | 4.2.1-rc4 |
Products include Sealos Project Sealos.
How do I fix CVE-2023-33190?
Upgrade github.com/labring/sealos to 4.2.1-rc4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-33190 being exploited?
There is no known exploitation of CVE-2023-33190 in the wild and no public exploit code.
Sources
Also known as GHSA-74j8-w7f9-pp62.