GHSA-wj8p-jj64-h7ff: Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC
Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATCThis vulnerability exists in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a malicious URL through the `overrides.yoke.cd/flight` annotation. The ATC controller downloads and executes the WASM module without proper URL validation, enabling attackers to create arbitrary Kubernetes resources or potentially escalate privileges to cluster-admin level.**Recommended CWE**: CWE-94 (Improper Control of Generation of Code - Code Injection)SummaryYoke ATC allows users to override the Flight WASM module URL via the `overrides.yoke.cd/flight` annotation on Custom Resources. The controller only checks if the user has `update` permission on `airways` resources but does not validate the WASM URL source. An attacker with CR create/update permissions can inject a malicious WASM URL, causing the ATC controller to download and execute arbitrary code.DetailsThe vulnerability exists in two code paths:**Source Point - Annotation Definition** (`pkg/flight/flight.go:41-42`):**Sink Point 1 - Admission Webhook** (`cmd/atc/handler.go:298-300`):**Sink Point 2 - Reconciler** (`internal/atc/reconciler_instance.go:264-269`):The permission check at `cmd/atc/handler.go:160-177` only verifies `update` permission on `airways` resources, not the ability to execute arbitrary WASM code:PoCEnvironment Setup**Prerequisites**:Docker installed and runningkubectl installedGo 1.21+ installedkind installed**Step 1: Create Kind cluster****Step 2: Build and install Yoke CLI**Expected output:**Step 3: Deploy ATC**Expected output:**Step 4: Verify ATC deployment and permissions**Expected output:**Step 5: Deploy Backend Airway example**Expected output:Exploitation Steps**Step 1: Create malicious WASM module**Create `malicious-wasm.go`:Compile to WASM:**Step 2: Host malicious WASM****Step 3: Get host IP accessible from Kind cluster****Step 4: Create malicious Backend CR**Expected output:**Step 5: Verify exploitation**Check ATC logs:Actual log output from verification:Check HTTP server logs (shows WASM download):Check created ConfigMap:Actual output from verification:Expected ResultThe malicious WASM module is downloaded and executed by the ATC controller, creating a ConfigMap named `stolen-credentials` in the cluster. This proves arbitrary code execution in the ATC controller context.Impact**Vulnerability Type**: Remote Code Execution (RCE) / Code Injection**Attack Prerequisites**:Attacker has permission to create/update Custom Resources managed by Yoke ATCNetwork access to host malicious WASM (can be external URL)**Impact Assessment**:**Confidentiality**: High - Attacker can create resources to exfiltrate data; if ClusterAccess is enabled, can read cluster secrets via host functions**Integrity**: High - Attacker can create/modify arbitrary Kubernetes resources through WASM output**Availability**: Medium - Attacker can disrupt cluster operations by creating malicious resources**Attack Scenario**:CI/CD developer or application developer with CR permissions creates a Backend CR with malicious annotationATC controller downloads and executes attacker-controlled WASMMalicious WASM creates backdoor resources or exfiltrates sensitive dataIf ClusterAccess is enabled, attacker can read secrets and escalate to cluster-adminSeverity**CVSS v3.1 Score**: 8.8 (High)**Vector**: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HAttack Vector (AV): Network - Malicious WASM can be hosted externallyAttack Complexity (AC): Low - Simple annotation injectionPrivileges Required (PR): Low - Only CR create/update permission neededUser Interaction (UI): None - Automatic execution on CR creationScope (S): Unchanged - Impact within ATC controller contextConfidentiality (C): High - Can access controller context dataIntegrity (I): High - Can create arbitrary resourcesAvailability (A): High - Can disrupt cluster operationsAffected VersionsYoke ATC v0.18.x and earlier versionsAll versions that support the `overrides.yoke.cd/flight` annotationPatched VersionsNo patch available at time of disclosure.Workarounds**Disable annotation override feature**: Remove or disable the `overrides.yoke.cd/flight` annotation processing in production environments**Network policy**: Restrict ATC controller's outbound network access to prevent downloading external WASM modules**RBAC hardening**: Limit CR create/update permissions to trusted users only**Admission webhook**: Deploy a validating webhook to reject CRs with `overrides.yoke.cd/flight` annotationsReferencesYoke Project: https://github.com/yokecd/yokeYoke ATC Documentation: https://yokecd.github.io/docs/airtrafficcontroller/atc/CWE-94: Improper Control of Generation of Code: https://cwe.mitre.org/data/definitions/94.htmlCreditscredit for:
@b0b0haha (603571786@qq.com)
@lixingquzhi (mayedoushidalao@163.com)
CVSS v3.1: 8.8