CVE-2022-46167

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted with `PATCH` capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operator and removing all the enforcement like Pod Security annotations, Network Policies, Limit Range and Resource Quota items. An attacker could detach the Namespace from a Tenant that is forbidding starting privileged Pods using the Pod Security labels by removing the OwnerReference, removing the enforcement labels, and being able to start privileged containers that would be able to start a generic Kubernetes privilege escalation. Patches have been released for version 0.1.3. No known workarounds are available.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b	Patch Third Party Advisory
https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1	Patch Third Party Advisory
https://github.com/clastix/capsule/releases/tag/v0.1.3	Patch Release Notes Third Party Advisory
https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:clastix:capsule:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-12-02 19:15

Updated : 2023-11-07 03:55

NVD link : CVE-2022-46167

Mitre link : CVE-2022-46167

CVE.ORG link : CVE-2022-46167

JSON object : View

Products Affected

clastix

capsule

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2022-46167", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-12-02T19:15:11.097", "references": [{"url": "https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/clastix/capsule/releases/tag/v0.1.3", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted with `PATCH` capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operator and removing all the enforcement like Pod Security annotations, Network Policies, Limit Range and Resource Quota items. An attacker could detach the Namespace from a Tenant that is forbidding starting privileged Pods using the Pod Security labels by removing the OwnerReference, removing the enforcement labels, and being able to start privileged containers that would be able to start a generic Kubernetes privilege escalation. Patches have been released for version 0.1.3. No known workarounds are available.\n"}, {"lang": "es", "value": "Capsule es un framework multiinquilino y basado en pol\u00edticas para Kubernetes. Antes de la versi\u00f3n 0.1.3, una cuenta de servicio implementada en un espacio de nombres de inquilino, cuando se le conced\u00edan capacidades \"PATCH\" en su propio espacio de nombres, pod\u00eda editarla y eliminar la referencia del propietario, rompiendo la conciliaci\u00f3n del operador de c\u00e1psula y eliminando toda la aplicaci\u00f3n. como anotaciones de seguridad de pod, pol\u00edticas de red, rango de los l\u00edmites y elementos de cuota de recursos. Un atacante podr\u00eda separar el espacio de nombres de un inquilino que proh\u00edbe iniciar pods privilegiados utilizando las etiquetas de seguridad del pod eliminando la referencia de propietario, eliminando las etiquetas de aplicaci\u00f3n y pudiendo iniciar contenedores privilegiados que podr\u00edan iniciar una escalada de privilegios gen\u00e9rica de Kubernetes. Se han lanzado parches para la versi\u00f3n 0.1.3. No hay workarounds disponibles."}], "lastModified": "2023-11-07T03:55:04.020", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:clastix:capsule:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65FF754C-955F-4358-82E4-A7DD544D75C3", "versionEndExcluding": "0.1.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}