CVE-2022-24817: Improper kubeconfig validation allows arbitrary code execution
First published: Fri May 06 2022(Updated: )
Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fluxcd Flux2 | >=0.1.0<0.29.0 | |
| Fluxcd Helm-controller | >=0.2.0<0.19.0 | |
| Fluxcd Kustomize-controller | >=0.1.0<0.23.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-24817?
CVE-2022-24817 is a vulnerability in Flux2, helm-controller, and kustomize-controller that allows code injection via malicious Kubeconfig, potentially leading to remote code execution.
What is the severity of CVE-2022-24817?
CVE-2022-24817 has a severity rating of 9.9 (Critical).
Which versions of Flux2 are affected by CVE-2022-24817?
Flux2 versions between 0.1.0 and 0.29.0 are affected by CVE-2022-24817.
Which versions of helm-controller are affected by CVE-2022-24817?
helm-controller versions between 0.1.0 and 0.19.0 are affected by CVE-2022-24817.
Which versions of kustomize-controller are affected by CVE-2022-24817?
kustomize-controller versions between 0.1.0 and 0.23.0 are affected by CVE-2022-24817.
How can CVE-2022-24817 be exploited?
CVE-2022-24817 can be exploited by using a malicious Kubeconfig to inject code, potentially leading to remote code execution.
How can I fix CVE-2022-24817?
To fix CVE-2022-24817, it is recommended to update Flux2, helm-controller, and kustomize-controller to versions that are not vulnerable. Refer to the official advisory for more information.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/severity
- agent/references
- agent/remedy
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/fluxcd
- canonical/fluxcd flux2
- version/fluxcd flux2/0.1.0
- canonical/fluxcd helm-controller
- version/fluxcd helm-controller/0.2.0
- canonical/fluxcd kustomize-controller
- version/fluxcd kustomize-controller/0.1.0