CVE-2024-40632 (YAML, published 2024-07-15T22:15Z)
Description: value: Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptible to SSRF, an attacker could potentially trigger a denial-of-service (DoS) attack by making requests to localhost:4191/shutdown. Linkerd could introduce an optional environment variable to control a token that must be passed as a header. Linkerd should reject shutdown requests that do not include this header. This issue has been addressed in release version edge-24.6.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/linkerd/linkerd2
Files changed:
charts/linkerd-control-plane/README.md
charts/linkerd-control-plane/values.yaml
charts/partials/templates/_proxy.tpl
cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
cli/cmd/testdata/inject_contour.golden.yml
cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_native_sidecar.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_params.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
cli/cmd/testdata/inject_emojivoto_list.golden.yml
cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
cli/cmd/testdata/inject_emojivoto_pod.golden.yml
cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
cli/cmd/testdata/install_controlplane_tracing_output.golden
cli/cmd/testdata/install_custom_domain.golden
cli/cmd/testdata/install_custom_registry.golden
cli/cmd/testdata/install_default.golden
cli/cmd/testdata/install_default_override_dst_get_nets.golden
cli/cmd/testdata/install_default_token.golden
cli/cmd/testdata/install_gid_output.golden
cli/cmd/testdata/install_ha_output.golden
cli/cmd/testdata/install_ha_with_overrides_output.golden
cli/cmd/testdata/install_heartbeat_disabled_output.golden
cli/cmd/testdata/install_helm_control_plane_output.golden
cli/cmd/testdata/install_helm_control_plane_output_ha.golden
cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden
cli/cmd/testdata/install_helm_output_ha_labels.golden
cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
cli/cmd/testdata/install_no_init_container.golden
cli/cmd/testdata/install_output.golden
cli/cmd/testdata/install_proxy_ignores.golden
cli/cmd/testdata/install_values_file.golden
controller/proxy-injector/fake/data/pod-with-debug.patch.json
controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
controller/proxy-injector/fake/data/pod.patch.json
pkg/charts/linkerd2/values.go
pkg/inject/inject.go
pkg/k8s/labels.go
Commit message: feat!: Add config to disable proxy /shutdown admin endpoint (#12705)

The proxy may expose a /shutdown HTTP endpoint on its admin server that may be used by `linkerd-await --shutdown` to trigger proxy shutdown after a process completes. If an application has an SSRF vulnerability, however, an attacker could use this endpoint to trigger proxy shutdown, causing a denial of service. This admin endpoint is only useful with linkerd-await; and this functionality is supplanted by Kubernetes Native Sidecars.

To address this potential issue, this change disables the proxy's admin endpoint by default. A helm value is introduced to support enabling the admin endpoint cluster-wide; and the `config.linkerd.io/proxy-admin-shutdown: enabled` annotation may be set to enable it the admin endpoint on an individual workload.

Signed-off-by: Alex Leong <alex@buoyant.io>

Vulnerable code:

Fixed code:
| proxy.enableShutdownEndpoint | bool | `false` | Enables the proxy's /shutdown admin endpoint |
  # -- Enables the proxy's /shutdown admin endpoint
  enableShutdownEndpoint: false
- name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
  value: {{.Values.proxy.enableShutdownEndpoint | quote}}
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
          - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
            value: "false"
          - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
            value: "false"
          - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
            value: "false"
          - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
            value: "false"
    - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
      value: "false"
    - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
      value: "false"
    - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
      value: "false"
    - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
      value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        {
          "name": "LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED",
          "value": "false"
        },
        {
          "name": "LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED",
          "value": "false"
        },
        {
          "name": "LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED",
          "value": "false"
        },
		EnableShutdownEndpoint               bool             `json:"enableShutdownEndpoint"`
		k8s.ProxyAdminShutdownAnnotation,
	if override, ok := annotations[k8s.ProxyAdminShutdownAnnotation]; ok {
		if override == k8s.Enabled || override == k8s.Disabled {
			values.Proxy.EnableShutdownEndpoint = override == k8s.Enabled
		} else {
			log.Warnf("unrecognized value used for the %s annotation, valid values are: [%s, %s]", k8s.ProxyAdminShutdownAnnotation, k8s.Enabled, k8s.Disabled)
		}
	}

	// ProxyAdminShutdownAnnotation can be used to override the
	// LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED config.
	ProxyAdminShutdownAnnotation = ProxyConfigAnnotationsPrefix + "/proxy-admin-shutdown"