Fission Namespace Escaping Vulnerability Fix (GHSA-vjhc-c14p-72q4, GHSA-gc3j-79f2-7vww)

Vulnerability Overview This vulnerability involves two obfuscated proxy primitives, allowing the low-privilege subject to schedule an action by a controller intermediary against the victim . Specifically: 1. GHSA-vjhc-c14p-72q4: points to another namespace, causing the builder (a cluster-scoped Service Account) to leak build artifacts to the attacker's pod's Service Account token / Secret / ConfigMap content via . 2. GHSA-gc3j-79f2-7vww: points to another namespace, causing the kubewatcher (a cluster-scoped watcher on Pods/Services/RCs/Jobs) to stream every event (including , , , names, ) from that namespace directly to the attacker's function. Scope of Impact Package: points to another namespace. KubernetesWatchTrigger: points to another namespace. Remediation Package (GHSA-vjhc-c14p-72q4) pkg/webhook/package.go:Validate: Rejects (empty is allowed; the controller defaults to the package's namespace). pkg/builder/pkgwatcher.go:build: Adds a guard before ; if cross-namespace, writes with a clear message and short-circuits. pkg/builder/common.go:buildPackage: Adds a guard before the function returns; if cross-namespace, returns . KubernetesWatchTrigger (GHSA-gc3j-79f2-7vww) pkg/webhook/kuberneteswatchtrigger.go: The kubewatcher marks (the chart's already contains , indicating a lagging mark—this aligns with the source-of-truth). rejects cross-namespace . pkg/kubewatcher/kubewatcher.go:createKubernetesWatch: Guards against cross-namespace scenarios and forces an empty to the trigger's own namespace, instead of the previous "all namespaces" semantics. Tests (New) pkg/webhook/package_test.go: Table-driven test for rejecting cross-namespace references. pkg/webhook/kuberneteswatchtrigger_test.go: Rejects cross-namespace references; an empty is rejected by the upstream . As a regression canary, we noted that the upstream validation is more permissive. pkg/kubewatcher/kubewatcher_test.go: Mock client tests verify that (1) the cross-namespace guard short-circuits before watch dialing; (2) an empty is forced to the trigger's namespace; (3) same-namespace operations remain valid. Behavioral Changes KubernetesWatchTrigger: An empty now only watches the trigger's own namespace, rather than all namespaces. Unchanged Items crds/v1/.yaml: No CEL rules added (deferred to design specifications; requires schema-block work outside this PR). charts/fission-all/templates/webhook-server/webhooks.yaml: Already correct ( for KWT). pkg/generated/**: No API type changes; no code generation required. Test Plan — 0 errors — All green CI passed (PR push workflow on this branch) Manual: In a kind cluster, a with pointing to an external namespace — expect admission rejection with a new message. Manual: a with pointing to an external namespace — expect admission rejection. Manual: Confirm that normal same-namespace KWTs still receive Pod events. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Fission Namespace Escaping Vulnerability Fix (GHSA-vjhc-c14p-72q4, GHSA-gc3j-79f2-7vww)

More from this source