GHSA-g8fc-vrcg-8vjg Constallation has pods exposed to peers in VPC

Not scored Published 15 Apr 2024

Attackers within the cloud VPC can access unexposed pods directly, potentially leaking sensitive data if network policies are not configured.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is GHSA-g8fc-vrcg-8vjg?

GHSA-g8fc-vrcg-8vjg is a missing authorization vulnerability in github.com/edgelesssys/constellation, published on 15 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Impact

Cilium allows outside actors (world entity) to directly access pods with their internal pod IP, even if they are not exposed explicitly (e.g. via LoadBalancer). A pod that does not authenticate clients and that does not exclude world traffic via network policy may leak sensitive data to an attacker inside the cloud VPC.

Patches

The issue has been patched in v2.16.3.

Workarounds

This network policy excludes all world traffic. It mitigates the problem, but will also block all desired external traffic. If vulnerable pods are known, a policy can be crafted to only firewall those instead (see also https://docs.cilium.io/en/stable/security/policy/language/#access-to-from-outside-cluster).

apiVersion: &#34;cilium.io/v2&#34;
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: &#34;from-world-to-role-public&#34;
spec:
  endpointSelector:
    matchLabels: {}
    #  role: public
  ingressDeny:
    - fromEntities:
      - world

References

The tracking bug for a Cilium-side fix is https://github.com/cilium/cilium/issues/25626.

Which versions are affected by GHSA-g8fc-vrcg-8vjg?

4 open source packages ship an affected version, including github.com/edgelesssys/constellation/v2 and github.com/edgelesssys/constellation.

Package	Affected	Fixed in
`github.com/edgelesssys/constellation/v2` Go	All versions	`2.16.3`
`github.com/edgelesssys/constellation/v2` Go	All versions	`2.16.3`
`github.com/edgelesssys/constellation/v2` Go	All versions	`2.16.3`
`github.com/edgelesssys/constellation` Go	All versions	None

How do I fix GHSA-g8fc-vrcg-8vjg?

Upgrade github.com/edgelesssys/constellation/v2 to 2.16.3 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is GHSA-g8fc-vrcg-8vjg being exploited?

There is no known exploitation of GHSA-g8fc-vrcg-8vjg in the wild and no public exploit code.

Sources

Also known as GO-2024-2727.