CVE-2024-43403 Kanister has a potential risk which can be leveraged to make a cluster-level privilege escalation
A malicious user with worker node access can escalate privileges to cluster level due to excessive permissions in the default Kanister operator configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-43403?
CVE-2024-43403 is a high-severity vulnerability in kanisterio kanister, published on 20 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kanister is a data protection workflow management tool. The kanister has a deployment called default-kanister-operator, which is bound with a ClusterRole called edit via ClusterRoleBinding. The "edit" ClusterRole is one of Kubernetes default-created ClusterRole, and it has the create/patch/udpate verbs of daemonset resources, create verb of serviceaccount/token resources, and impersonate verb of serviceaccounts resources. A malicious user can leverage access the worker node which has this component to make a cluster-level privilege escalation.
Weakness: CWE-269
Which versions are affected by CVE-2024-43403?
3 open source packages ship an affected version, including github.com/kanisterio/kanister.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kanisterio/kanister Go | All versions | None |
github.com/kanisterio/kanister Go | All versions | 0.0.0-20240926084453-1f40f03d8432 |
github.com/kanisterio/kanister Go | All versions | 0.0.0-20240926084453-1f40f03d8432 |
How do I fix CVE-2024-43403?
Upgrade github.com/kanisterio/kanister to 0.0.0-20240926084453-1f40f03d8432 or later.
Is CVE-2024-43403 being exploited?
There is no known exploitation of CVE-2024-43403 in the wild and no public exploit code.
Sources
Also known as GHSA-h27c-6xm3-mcqp, GO-2024-3080.