CVE-2024-33398 piraeus-operator allows attacker to impersonate service account
An attacker can impersonate a service account to list cluster secrets due to excessive ClusterRole permissions in the piraeus-operator.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-33398?
CVE-2024-33398 is a high-severity vulnerability in n/a, published on 3 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is a ClusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, which allows an attacker to impersonate the service account bound to this ClusterRole and use its high-risk privileges to list confidential information across the cluster.
Weakness: CWE-269
Which versions are affected by CVE-2024-33398?
4 open source packages ship an affected version, including github.com/piraeusdatastore/piraeus-operator/v2 and github.com/piraeusdatastore/piraeus-operator.
| Package | Affected | Fixed in |
|---|---|---|
github.com/piraeusdatastore/piraeus-operator/v2 Go | All versions | None |
github.com/piraeusdatastore/piraeus-operator/v2 Go | All versions to 2.5.0 | None |
github.com/piraeusdatastore/piraeus-operator/v2 Go | All versions to 2.5.0 | None |
github.com/piraeusdatastore/piraeus-operator Go | All versions | None |
How do I fix CVE-2024-33398?
Upgrade to a fixed version.
Is CVE-2024-33398 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-33398 exists.
Sources
Also known as GHSA-6fg2-hvj9-832f, GO-2024-2811, MINI-628p-pq29-gfr2, MINI-f534-wvmq-3vcw.