CVE-2022-46167— Capsule Console 安全漏洞

Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted with `PATCH` capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operator and removing all the enforcement like Pod Security annotations, Network Policies, Limit Range and Resource Quota items. An attacker could detach the Namespace from a Tenant that is forbidding starting privileged Pods using the Pod Security labels by removing the OwnerReference, removing the enforcement labels, and being able to start privileged containers that would be able to start a generic Kubernetes privilege escalation. Patches have been released for version 0.1.3. No known workarounds are available.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

授权机制不正确

Capsule Console 安全漏洞

Capsule Console是美国Capsule公司的一个 Capsule8 的 Web 界面。用于事件管理、传感器配置和系统分析。 Capsule 0.1.3之前的版本存在安全漏洞，该漏洞源于攻击者可以通过删除OwnerReference，删除强制标签，并能够启动能够启动通用Kubernetes特权升级的特权容器，从禁止使用Pod安全标签启动特权Pod的租户中分离命名空间。

N/A

N/A