CVE-2021-3495: High severity Netlify Kiali-operator vulnerability
An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
If you create a kiali instance, then you can specify any project in yaml and it will be installed there, ignoring the rights to this project. If current user has edit permissions to 'user-namespace' but not to 'any-namespace', kiali anyway will be created in 'any-namespace'.
Reference:
https://issues.redhat.com/browse/KIALI-3278
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kiali/kiali-operatorto a version that resolves this vulnerability.Fixed in 1.33.0 - Upgrade
Upgrade
redhat/kiali/kiali-operatorto a version that resolves this vulnerability.Fixed in 1.24.7 - Upgrade
Upgrade
kiali-operatorto a version that resolves this vulnerability.Fixed in 1.33.0 - Upgrade
Upgrade
kiali-operatorto a version that resolves this vulnerability.Fixed in 1.24.7 - Compensating control
Until upgraded, restrict cluster permissions so that users who can deploy kiali operands cannot edit or deploy into namespaces they should not control (the flaw can allow installation into 'any-namespace' / arbitrary projects by specifying them in YAML).
Event History
Frequently Asked Questions
What is CVE-2021-3495?
CVE-2021-3495 is an incorrect access control flaw in the kiali-operator.
What is the severity of CVE-2021-3495?
CVE-2021-3495 has a severity rating of 8.8 (High).
Which software versions are affected by CVE-2021-3495?
CVE-2021-3495 affects Netlify Kiali-operator versions before 1.33.0 and before 1.24.7, as well as Redhat Openshift Service Mesh versions 1.0 and 2.0.
How can an attacker exploit CVE-2021-3495?
An attacker with basic level access to the cluster can deploy a kiali operand and use the vulnerability to deploy a given image anywhere in the cluster.
Are there any references for CVE-2021-3495?
Yes, you can find more information about CVE-2021-3495 in the following references: [link 1](https://bugzilla.redhat.com/show_bug.cgi?id=1947361) and [link 2](https://kiali.io/news/security-bulletins/kiali-security-003/).