cert-manager Direct ACME Challenge Bypasses Issuer DNS01 Solver Policy (CVE-2024-43185)

Vulnerability Overview Title: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials Description: Summary: cert-manager allows namespace users to directly create resources, bypassing the Issuer's DNS01 solver policy and using the ClusterIssuer's DNS credentials. Attack Prerequisites: - The attacker can create resources in at least one namespace. - The cert-manager controller is running and coordinating resources. - A usable exists in the cluster. - The referenced has a DNS01 solver that uses Secrets in the cluster resource namespace or relies on enabled cluster-level credentials. - The cluster is multi-tenant, or namespace users are separated from platform-owned ClusterIssuer and DNS credential management. Severity: This vulnerability allows namespace users to bypass the Issuer's DNS credentials or cloud credentials, resulting in credential leakage. Scope Affected Components: - ACME Challenge Admission Validation - ACME Challenge Controller - DNS01 solver selection and DNS provider construction - Default aggregated RBAC for Affected Versions: - Tested Versions: v1.18.0, v1.19.5, v1.18.6 Remediation Recommended Fixes: - Reject or ignore user-created resources unless the controller or admission layer can confirm that an existing cert-manager-created owns the . - Do not rely solely on the existence of an for validation. Verify that the referenced exists, is controlled by cert-manager's workflow, and matches the 's UID, owner reference, labels, DNS name, authorization URL, challenge URL, token key, and Issuer reference. - Ensure that the solver used by the is selected by the controller from the referenced Issuer/ClusterIssuer. The controller should not accept manually provided solver provider configurations unless within a supported workflow. - Remove and creation permissions from aggregated roles, unless the direct user is a supported boundary. - Add admission validation or CEL rules to prevent direct users from controlling sensitive solver provider fields on standalone or unverifiable . POC Code PoC A: Low-privilege namespace users can persistently create direct ClusterIssuer Challenges PoC B: acme-dns provider sends referenced credentials to the configured host Expected Output Credential Impact Specific credential leakage is demonstrated in this report for the acme-dns provider. The host controlled by the attacker receives the and values from the referenced account JSON. For other DNS01 providers, this report should be treated as a risk regarding credential usage, policy bypass, and DNS mutation. The controller may use platform-owned secrets or cloud credentials to perform DNS operations that are dictated by the attacker-controlled solver provider configuration. Specific provider credential leakage should not be assumed to occur without separate provider-level POCs. Expected Behavior Users should not be able to create standalone resources that cause cert-manager to use the solver configuration from the referenced Issuer or ClusterIssuer. If direct resources are intentionally exposed, the controller should only coordinate that are owned by a cert-manager-created and whose solver configuration is selected from the referenced Issuer. Actual Behavior Users with namespace-level creation permissions can create direct with arbitrary solver configurations. The controller coordinates them, derives credential namespaces and cloud credential permissions from the , and uses the attacker-controlled solver provider settings.

Goal Reached Thanks to every supporter — we hit 100%!

cert-manager Direct ACME Challenge Bypasses Issuer DNS01 Solver Policy (CVE-2024-43185)

More from this source