REDHAT-BUG-2524894: Hawtio-operator vulnerability
C-1 from Project Glasswing security audit of hawtio-operator. The operator reads the OpenShift Service CA private signing key and mints client certificates with a Subject CN supplied by the unprivileged author of the namespaced Hawtio CR. Any principal holding the edit or admin aggregated role in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject, enabling impersonation of any in-cluster service identity. Source: hawtio-operator-security-audit.json#C-1.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any principal with the aggregated edit or admin role in any namespace can create or control a namespaced Hawtio custom resource and supply the certificate Subject CN.
What does successful exploitation allow?
An attacker can obtain a certificate signed by the OpenShift Service CA with an arbitrary subject. This can enable impersonation of any in-cluster service identity.
What access does the operator have that enables the issue?
The hawtio-operator reads the OpenShift Service CA private signing key and uses it to mint client certificates. The certificate subject is derived from a value supplied by an unprivileged author of the namespaced Hawtio custom resource.