CVE-2024-25133 Openshift-dedicated: hive: rce through aws/kubernetes client configuration leads to privilege escalation
A developer on a Hive-enabled OpenShift Dedicated cluster can escalate to cluster-admin by executing arbitrary commands via client configuration flaws.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-25133?
CVE-2024-25133 is a high-severity vulnerability in github.com/openshift/hive, published on 31 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enabled cluster to obtain cluster-admin privileges by executing arbitrary commands on the hive/hive-controllers pod.
Weakness: CWE-284
Which versions are affected by CVE-2024-25133?
3 open source packages ship an affected version, including github.com/openshift/hive.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openshift/hive Go | All versions | None |
github.com/openshift/hive Go | All versions to 1.1.16 | None |
github.com/openshift/hive Go | All versions to 1.1.16 | None |
How do I fix CVE-2024-25133?
Apply the vendor's patch.
Is CVE-2024-25133 being exploited?
There is no known exploitation of CVE-2024-25133 in the wild and no public exploit code.
Sources
Also known as GHSA-wgqq-9qh8-wvqv, GO-2024-3360.