CVE-2024-42480 Kamaji's RBAC Roles for `etcd` are not disjunct
Attackers can read, write, and delete data across different control planes due to overly permissive RBAC roles in Kamaji.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-42480?
CVE-2024-42480 is a high-severity missing authorization vulnerability in clastix kamaji, published on 12 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed in edge-24.8.2.
Weakness: CWE-284
Which versions are affected by CVE-2024-42480?
3 open source packages ship an affected version, including github.com/clastix/kamaji. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/clastix/kamaji Go | All versions | None |
github.com/clastix/kamaji Go | All versions to 1.0.0 | None |
github.com/clastix/kamaji Go | All versions to 1.0.0 | None |
Products include Clastix Kamaji.
How do I fix CVE-2024-42480?
No fix has been published for CVE-2024-42480 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-42480 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-42480 exists.
Sources
Also known as GHSA-6r4j-4rjc-8vw5, GO-2024-3063.