REDHAT-BUG-2512154: Path Traversal
ClusterID is read from ManagedCluster.Status.ClusterClaims["id.openshift.io"] (fallback id.k8s.io). ClusterClaims are set by the registration/work agent on the managed (spoke) cluster and synced verbatim into the hub ManagedCluster.status -- they are spoke-controlled data crossing a trust boundary. The value is concatenated raw into the request path: http.NewRequest("GET", endpoint+"/cluster/"+cluster.ClusterID+"/reports", nil), with the hub's pull-secret bearer token attached. No UUID validation or URL encoding is applied. A compromised spoke can inject path traversal sequences or redirect the authenticated request to unintended API endpoints.
Upstream: stolostron/insights-client
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2512154?
The severity of REDHAT-BUG-2512154 is medium with a rating of 4.
How do I fix REDHAT-BUG-2512154?
To address REDHAT-BUG-2512154, ensure appropriate validation and sanitization of ClusterClaims data before synchronization.
What type of vulnerability is REDHAT-BUG-2512154?
REDHAT-BUG-2512154 is classified as a Path Traversal vulnerability.
What software is affected by REDHAT-BUG-2512154?
The affected software for REDHAT-BUG-2512154 is stolostron/insights-client.
What is the main risk associated with REDHAT-BUG-2512154?
The main risk associated with REDHAT-BUG-2512154 is the potential for malicious data manipulation due to spoke-controlled data crossing a trust boundary.