GitHub Security Advisory: GHSA-wj8p-jj64-h7ff
Package: github.com/yokecd/yoke (GO)
Severity: HIGH (CVSS 8.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 0.19.0
Patched in: unpatched

Summary: Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC

Details:
# Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC

This vulnerability exists in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a malicious URL through the `overrides.yoke.cd/flight` annotation. The ATC controller downloads and executes the WASM module without proper URL validation, enabling attackers to create arbitrary Kubernetes resources or potentially escalate privileges to cluster-admin level.

**Recommended CWE**: CWE-94 (Improper Control of Generation of Code - Code Injection)

## Summary

Yoke ATC allows users to override the Flight WASM module URL via the `overrides.yoke.cd/flight` annotation on Custom Resources. The controller only checks if the user has `update` permission on `airways` resources but does not validate the WASM URL source. An attacker with CR create/update permissions can inject a malicious WASM URL, causing the ATC controller to download and execute arbitrary code.

## Details

The vulnerability exists in two code paths:

**Source Point - Annotation Definition** (`pkg/flight/flight.go:41-42`):
```go
const (
    AnnotationOverrideFlight = "overrides.yoke.cd/flight"
    AnnotationOverrideMode   = "overrides.yoke.cd/mode"
)
```

**Sink Point 1 - Admission Webhook** (`cmd/atc/handler.go:298-300`):
```go
if overrideURL, _, _ := unstructured.NestedString(cr.Object, "metadata", "annotations", flight.AnnotationOverrideFlight); overrideURL != "" {
    xhttp.AddRequestAttrs(r.Context(), slog.Group("overrides", "flight", overrideURL))
    takeoffParams.Flight.Path = overrideURL  // User-provided URL used directly
}
```

**Sink Point 2 - Reconciler** (`internal/atc/reconciler_instance.go:264-269`):
```go
if overrideURL, _, _ := unstructured.NestedString(resource.Object, "metadata", "annotations", flight.AnnotationOverrideFlight); overrideURL != "" {
    ctrl.Logger(ctx).Warn("using override module", "url", overrideURL)
    // Simply set the override URL as the flight path and let yoke load and execute the wasm module
    takeoffParams.Flight.Path = overrideURL  // User-provided URL used directly without validation
}
```

The permission check at `cmd/atc/handler.go:160-177` only verifies `update` permission on `airways` resources, not the ability to execute arbitrary WASM code:
```go
accessReview, err := params.Client.Clientset.AuthorizationV1().SubjectAccessReviews().Create(
    r.Context(),
    &authorizationv1.SubjectAccessReview{
        Spec: authorizationv1.SubjectAccessReviewSpec{
            ResourceAttributes: &authorizationv1.ResourceAttributes{
                Verb:     "update",
                Group:    "yoke.cd",
                Version:  "v1alpha1",
                Resource: "airways",  // Only checks airway update permission
            },
        },
    },
)
```

## PoC

### Environment Setup

**Prerequisites**:
- Docker instal