CVE-2023-51699 OS Command Injection for Fluid Users with JuicefsRuntime

Q: Which versions are affected by CVE-2023-51699?

3 open source packages ship an affected version, including github.com/fluid-cloudnative/fluid. It affects 1 product.

Q: Is CVE-2023-51699 being exploited?

There is no known exploitation of CVE-2023-51699 in the wild and no public exploit code.

Q: How do I fix CVE-2023-51699?

Upgrade github.com/fluid-cloudnative/fluid to 0.9.3 or later.

Medium 4.0 Published 15 Mar 2024 Updated 2 Aug 2024

Authenticated users with CRD creation rights can execute arbitrary OS commands in JuicefsRuntime containers, leading to unauthorized data access or modification.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-51699?

CVE-2023-51699 is a medium-severity command injection vulnerability in fluid-cloudnative fluid, published on 15 Mar 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Fluid is an open source Kubernetes-native Distributed Dataset Orchestrator and Accelerator for data-intensive applications. An OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to unauthorized access, modification or deletion of data. Users who're using versions < 0.9.3 with JuicefsRuntime should upgrade to v0.9.3.

Weakness: CWE-78

Which versions are affected by CVE-2023-51699?

3 open source packages ship an affected version, including github.com/fluid-cloudnative/fluid. It affects 1 product.

Package	Affected	Fixed in
`github.com/fluid-cloudnative/fluid` Go	All versions	`0.9.3`
`github.com/fluid-cloudnative/fluid` Go	All versions	`0.9.3`
`github.com/fluid-cloudnative/fluid` Go	All versions	`0.9.3`

Products include Linuxfoundation Fluid.

How do I fix CVE-2023-51699?

Upgrade github.com/fluid-cloudnative/fluid to 0.9.3 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-51699 being exploited?

There is no known exploitation of CVE-2023-51699 in the wild and no public exploit code.

CVE-2023-30840 On a compromised node, the fluid-csi service account can be used to modify node specs Medium 5.8

Sources

Also known as GHSA-wx8q-4gm9-rj2g, GO-2024-2644.