CVE-2023-29018 OpenFeature Operator vulnerable to Cluster-level Privilege Escalation

2023-04-1418:47:03

CWE-269

GitHub_M

www.cve.org

openfeature

privilege escalation

vulnerability

cve-2023-29018

operator

arbitrary code execution

permissions

cluster

dos

sensitive data

version 0.2.32

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

52.3%

JSON

The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on open-feature-operator-controller-manager to escalate the privileges of any SA in the cluster. The increased privileges could be used to modify cluster state, leading to DoS, or read sensitive data, including secrets. Version 0.2.32 mitigates this issue by restricting the resources the open-feature-operator-controller-manager can modify.

CNA Affected

[
  {
    "vendor": "open-feature",
    "product": "open-feature-operator",
    "versions": [
      {
        "version": "< 0.2.32",
        "status": "affected"
      }
    ]
  }
]