BMO Cross-Namespace Secret Exposure via BMH CRD (CVE-2024-43803)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: BMO can expose particularly named secrets from other namespaces via BMH CRD - Publisher: tuminoid - Vulnerability ID: GHSA-pqfh-xh7w-7h3p - Release Date: Yesterday 2. Affected Versions: - Affected Versions: < v0.8.0 - Fixed Versions: v0.8.0, v0.6.2, v0.5.2 3. Impact: - Description: The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost (BMH) Custom Resource Definition (CRD) allows the userData, metaData, and networkData fields to be specified as references to Kubernetes Secrets. These fields include Name and Namespace, meaning the BareMetalOperator will read Secrets from any namespace. Users with permissions to create or edit BareMetalHosts can exploit this by using the userData field to expose Secrets from other namespaces. 4. Limiting Factors: - BMO only reads keys named value (or userData, metaData, or networkData), which limits the scope of exposure. The key "value" is a commonly used name. 5. Mitigation: - The BMO has been fixed to prevent accepting Secrets from other namespaces as BMH input. Any BMH configuration can only read Secrets from the same namespace. - Users should upgrade to v0.8.0, v0.6.2, or v0.5.2. Before upgrading, BMC Secrets should be copied to the namespace where BMH resides. After upgrading, old Secrets should be deleted. 6. Workarounds: - Operators can configure BMO RBAC to be namespace-bound for Secrets instead of cluster-bound, preventing BMO from accessing Secrets in other namespaces. 7. Reference Links: - NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43803 - GitHub Issues: #1929, #1930, #1931 This information provides a detailed description of the vulnerability, affected versions, mitigation steps, workarounds, and relevant reference links.

Goal Reached Thanks to every supporter — we hit 100%!

BMO Cross-Namespace Secret Exposure via BMH CRD (CVE-2024-43803)

More from this source