CVE-2022-24817: Improper kubeconfig validation allows arbitrary code execution
Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the spec.kubeConfig field in Flux Kustomization and HelmRelease objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-24817?
CVE-2022-24817 is a vulnerability in Flux2, helm-controller, and kustomize-controller that allows code injection via malicious Kubeconfig, potentially leading to remote code execution.
What is the severity of CVE-2022-24817?
CVE-2022-24817 has a severity rating of 9.9 (Critical).
Which versions of Flux2 are affected by CVE-2022-24817?
Flux2 versions between 0.1.0 and 0.29.0 are affected by CVE-2022-24817.
Which versions of helm-controller are affected by CVE-2022-24817?
helm-controller versions between 0.1.0 and 0.19.0 are affected by CVE-2022-24817.
Which versions of kustomize-controller are affected by CVE-2022-24817?
kustomize-controller versions between 0.1.0 and 0.23.0 are affected by CVE-2022-24817.
How can CVE-2022-24817 be exploited?
CVE-2022-24817 can be exploited by using a malicious Kubeconfig to inject code, potentially leading to remote code execution.
How can I fix CVE-2022-24817?
To fix CVE-2022-24817, it is recommended to update Flux2, helm-controller, and kustomize-controller to versions that are not vulnerable. Refer to the official advisory for more information.