GitHub Security Advisory: GHSA-965m-v4cc-6334
Package: github.com/yokecd/yoke (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: <= 0.19.0
Patched in: unpatched

Summary: Unauthenticated Admission Webhook Endpoints in Yoke ATC

Details:
# Unauthenticated Admission Webhook Endpoints in Yoke ATC

This vulnerability exists in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send AdmissionReview requests to the webhook, bypassing Kubernetes API Server authentication. This enables attackers to trigger WASM module execution in the ATC controller context without proper authorization.

**Recommended CWE**: CWE-306 (Missing Authentication for Critical Function)

## Summary

Yoke ATC implements multiple Admission Webhook endpoints (`/validations/{airway}`, `/validations/resources`, `/validations/flights.yoke.cd`, `/validations/airways.yoke.cd`, etc.) that process AdmissionReview requests. These endpoints do not implement TLS client certificate authentication or request source validation. Any client that can reach the ATC service within the cluster can send requests directly to these endpoints, bypassing the Kubernetes API Server's authentication and authorization mechanisms.

## Details

The vulnerability exists in the HTTP handler implementation where webhook endpoints accept and process requests without verifying the client identity.

**Vulnerable Endpoint Handlers** (`cmd/atc/handler.go:147-335`):
```go
mux.HandleFunc("POST /validations/{airway}", func(w http.ResponseWriter, r *http.Request) {
    var review admissionv1.AdmissionReview
    if err := json.NewDecoder(r.Body).Decode(&review); err != nil {
        http.Error(w, fmt.Sprintf("failed to decode review: %v", err), http.StatusBadRequest)
        return
    }
    // No authentication check - request is processed directly
    // ...
})
```

**Additional Unauthenticated Endpoints**:
- `/validations/resources` (`cmd/atc/handler.go:337-538`)
- `/validations/external-resources` (`cmd/atc/handler.go:540-597`)
- `/validations/airways.yoke.cd` (`cmd/atc/handler.go:599-636`)
- `/validations/flights.yoke.cd` (`cmd/atc/handler.go:638-733`)
- `/crdconvert/{airway}` (`cmd/atc/handler.go:61-145`)

The code lacks:
1. TLS client certificate verification
2. Request source validation (verifying requests come from kube-apiserver)
3. Any form of authentication middleware

## PoC

### Environment Setup

**Prerequisites**:
- Docker installed and running
- kubectl installed
- Go 1.21+ installed
- kind installed

**Step 1: Create Kind cluster**
```bash
cat > /tmp/kind-config.yaml << 'EOF'
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
name: yoke-vuln-test
nodes:
- role: control-plane
EOF

kind create cluster --config /tmp/kind-config.yaml
```

**Step 2: Build and install Yoke CLI**
```bash
git clone https://github.com/yokecd/yoke.git
cd yoke
GOPROXY=direct GOSUMDB=off go build -o /tmp/yoke ./cmd/yoke
```

**Step 3: Deploy ATC**
```bash
/tmp/yoke takeoff --create-namespace --namespace atc -wait 120s atc oci://ghcr.io/yokecd/atc-installer:latest
```

**Step 4: Deploy Backend Airway example**
```bash
/t