REDHAT-BUG-2524896: High severity hawtio-operator vulnerability
H-1 from Project Glasswing security audit of hawtio-operator. The ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. The controller-runtime label-selector cache is a memory optimisation only; the SA token authorises GET/LIST on every Secret. Compromise of the operator pod yields read of every Secret in the cluster. Source: hawtio-operator-security-audit.json#H-1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Constrain the hawtio-operator ServiceAccount permissions by reducing the ClusterRole scope so it no longer grants secrets permissions (create/get/list/update/watch) across all namespaces; limit Secret access to only the specific namespaces/resources the operator requires.
Event History
Frequently Asked Questions
What level of access does an attacker gain after compromising the operator pod?
The operator's service account can read Secrets across every namespace in the cluster. Its granted permissions include get and list on Secrets, so the compromise is not limited to Secrets associated with a particular Hawtio deployment.
Does the controller-runtime label-selector cache restrict the operator's authorization to access Secrets?
No. The label-selector cache is only a memory optimization; it does not constrain the service account token. The token remains authorized for GET and LIST operations on every Secret in the cluster.