REDHAT-BUG-2524895: High severity hawtio-operator vulnerability
M-2 from Project Glasswing security audit of hawtio-operator. Cluster-mode Hawtio creates a cluster-scoped OAuthClient with automatic grant approval and no client secret (public client). Combined with tenant-controlled Route hostnames, a malicious tenant can register an arbitrary host as a valid OAuth redirect target and obtain cluster user access tokens without consent. Source: hawtio-operator-security-audit.json#M-2.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Cluster-mode Hawtio deployments are exposed because they create a cluster-scoped OAuthClient configured for automatic grant approval and without a client secret. The issue also depends on tenants being able to control Route hostnames.
What does an attacker need to exploit it?
An attacker needs tenant-level ability to register or control a Route hostname. They can use that hostname as an OAuth redirect target for the public OAuth client.
What is the impact of successful exploitation?
A malicious tenant can obtain cluster user access tokens without the user's consent. The affected OAuth client is cluster-scoped, so the risk extends beyond a single tenant's namespace.