Fission Fix: Denying Dangerous PodSpec Fields to Prevent Node Escape

Vulnerability Overview This vulnerability addresses the rejection of dangerous fields within Fission Environments and Functions. Specifically, it blocks fields such as , , , , , volumes, overrides, and the capabilities , , , , , and . The presence of these fields could allow tenants with Environment or Function-CRUD permissions to inject podspecs containing dangerous configurations, thereby gaining the ability to escape nodes and take over the cluster. Impact Scope Environment and Function Objects: Any Environment or Function object that explicitly sets the aforementioned dangerous fields will be rejected upon submission. Cluster Security: The existence of these dangerous fields could grant tenants unnecessary privileges, subsequently compromising the security of the entire cluster. Remediation Steps 1. Validate PodSpec Safety: - Introduce a new function to reject PodSpecs containing dangerous fields. - Invoke this function within and / . 2. Expand Validation Webhook Coverage: - Extend the validation webhook from handling only operations to handling both and operations. - Update the webhook configuration in the Helm templates accordingly. 3. Defense in Depth: - Unconditionally strip dangerous fields at the merge layer to prevent bypassing the webhook. - Preserve tokens for and the ServiceAccount, while stripping all other dangerous fields. 4. Testing: - Add multiple test cases to cover various dangerous fields and edge cases. - Ensure that code coverage meets the required standards. POC Code No specific POC code or exploit code was provided on the page. Summary This vulnerability strengthens Fission's security by rejecting dangerous fields in Environments and Functions. The remediation strategy includes introducing a validation function, expanding webhook coverage, implementing defense-in-depth measures, and conducting comprehensive testing. These measures effectively prevent tenants from gaining unnecessary privileges through dangerous fields, thereby ensuring cluster security.

Goal Reached Thanks to every supporter — we hit 100%!

Fission Fix: Denying Dangerous PodSpec Fields to Prevent Node Escape

More from this source