GHSA-965m-v4cc-6334: Unauthenticated Admission Webhook Endpoints in Yoke ATC
Unauthenticated Admission Webhook Endpoints in Yoke ATCThis vulnerability exists in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send AdmissionReview requests to the webhook, bypassing Kubernetes API Server authentication. This enables attackers to trigger WASM module execution in the ATC controller context without proper authorization.**Recommended CWE**: CWE-306 (Missing Authentication for Critical Function)SummaryYoke ATC implements multiple Admission Webhook endpoints (`/validations/{airway}`, `/validations/resources`, `/validations/flights.yoke.cd`, `/validations/airways.yoke.cd`, etc.) that process AdmissionReview requests. These endpoints do not implement TLS client certificate authentication or request source validation. Any client that can reach the ATC service within the cluster can send requests directly to these endpoints, bypassing the Kubernetes API Server's authentication and authorization mechanisms.DetailsThe vulnerability exists in the HTTP handler implementation where webhook endpoints accept and process requests without verifying the client identity.**Vulnerable Endpoint Handlers** (`cmd/atc/handler.go:147-335`):**Additional Unauthenticated Endpoints**:`/validations/resources` (`cmd/atc/handler.go:337-538`)`/validations/external-resources` (`cmd/atc/handler.go:540-597`)`/validations/airways.yoke.cd` (`cmd/atc/handler.go:599-636`)`/validations/flights.yoke.cd` (`cmd/atc/handler.go:638-733`)`/crdconvert/{airway}` (`cmd/atc/handler.go:61-145`)The code lacks:TLS client certificate verificationRequest source validation (verifying requests come from kube-apiserver)Any form of authentication middlewarePoCEnvironment Setup**Prerequisites**:Docker installed and runningkubectl installedGo 1.21+ installedkind installed**Step 1: Create Kind cluster****Step 2: Build and install Yoke CLI****Step 3: Deploy ATC****Step 4: Deploy Backend Airway example**Exploitation Steps**Step 1: Create attacker pod****Step 2: Probe webhook endpoints from attacker pod**Actual output from verification:The HTTP 500 response (not 401/403) indicates the endpoint is accessible without authentication. The error is due to invalid request body format, not authentication failure.**Step 3: Send crafted AdmissionReview request**Create malicious request file:Send the request:Actual output from verification:**Step 4: Verify ATC logs**Actual log output:The `elapsed: 435ms` indicates WASM module execution occurred.Expected ResultThe attacker pod successfully sends AdmissionReview requests directly to the ATC webhook endpoint without any authentication. The ATC controller processes the request and executes the WASM module, proving that:No TLS client certificate is requiredNo request source validation occursThe fake `userInfo` is accepted without verificationWASM modules are executed based on unauthenticated requestsImpact**Vulnerability Type**: Missing Authentication / Authentication Bypass**Attack Prerequisites**:Attacker has access to a pod within the cluster networkNetwork policies do not restrict access to the ATC service (common in default configurations)**Impact Assessment**:**Confidentiality**: Medium - Attacker can trigger WASM execution which may access controller context data**Integrity**: High - Combined with VUL-001, attacker can create arbitrary Kubernetes resources**Availability**: Medium - Attacker can cause resource exhaustion through repeated requests**Attack Scenario**:Attacker compromises a pod or gains access to the cluster networkAttacker sends crafted AdmissionReview requests directly to ATC webhookATC processes requests without verifying they came from the API ServerCombined with annotation injection (VUL-001), attacker can execute arbitrary WASM codeMalicious WASM can create resources or exfiltrate data using ATC's cluster-admin privilegesSeverity**CVSS v3.1 Score**: 7.5 (High)**Vector**: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NAttack Vector (AV): Network - Accessible from cluster networkAttack Complexity (AC): Low - Simple HTTP requestPrivileges Required (PR): None - No authentication requiredUser Interaction (UI): None - Automatic processingScope (S): UnchangedConfidentiality (C): None - Direct impact limitedIntegrity (I): High - Can trigger unauthorized WASM executionAvailability (A): None - No direct availability impactNote: When combined with VUL-001, the overall impact increases significantly.Affected VersionsYoke ATC v0.18.x and earlier versionsAll versions that implement Admission Webhook endpoints without client authenticationPatched VersionsNo patch available at time of disclosure.Workarounds**Network Policy**: Deploy NetworkPolicy to restrict access to ATC service, allowing only kube-apiserver to connect**Service Mesh**: Use a service mesh (Istio, Linkerd) to enforce mTLS between services**Pod Security**: Implement strict pod security policies to limit which pods can be created in the clusterReferencesYoke Project: https://github.com/yokecd/yokeKubernetes Admission Webhooks: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/CWE-306: Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.htmlCreditscredit for:
@b0b0haha (603571786@qq.com)
@lixingquzhi (mayedoushidalao@163.com)
CVSS v3.1: 7.5