Improper kubeconfig validation allows arbitrary code execution
Date: 2022-05
Affected: go/github.com/fluxcd/helm-controller, go/github.com/fluxcd/kustomize-controller, go/github.com/fluxcd/flux2
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2022-24817
CWE: CWE-94
CVSS: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Flux2 can reconcile the state of a remote cluster when provided with a [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/#file-references) with the correct access rights. `Kubeconfig` files can define [commands](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target cluster, could craft a `kubeconfig` to execute arbitrary code inside the controller’s container. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. ### Impact Within the affected versions range, one of the permissions set below would be required for the vulnerability to be exploited: - Direct access to the cluster to create Flux `Kustomization` or `HelmRelease` objects and Kubernetes Secrets. - Direct access to the cluster to modify existing Kubernetes secrets being used as `kubeconfig` in existing Flux `Kustomization` or `HelmRelease` objects. - Direct access to the cluster to modify existing Flux `Kustomization` or `HelmRelease` objects and access to create or modify existing Kubernetes secrets. - Access rights to make changes to a configured Flux Source (i.e. Git repository). ### Patches This vulnerability was fixed in kustomize-controller [v0.23.0](https://github.com/fluxcd/kustomize-contro


Mitigations:

Architectural layers (MAESTRO):