SkyPilot Service Account Privilege Escalation via Insufficient Role Validation

Vulnerability Overview This vulnerability involves an issue with the validation of service account role permissions in the SkyPilot platform. Specifically, the API endpoint does not sufficiently validate the requested role name when updating a service account's role. It only checks if the role is "admin" and fails to consider other possible valid role names. This allows an attacker to construct specific requests to elevate a service account's role to "admin", thereby gaining administrator privileges. Scope of Impact Affected Component: Service account role management functionality within the SkyPilot platform. Potential Risks: Attackers can exploit this vulnerability to elevate service account privileges, potentially accessing or modifying sensitive data, executing unauthorized operations, or even gaining complete control over the platform. Remediation Plan 1. Enhance Role Validation: - When updating a service account's role, in addition to checking if the role is "admin", verify whether the role exists in the list of allowed roles. - Use to retrieve the list of supported roles and perform validation during the role update process. 2. Refine Permission Controls: - Clearly define the permission scope for each role, ensuring that only users with appropriate permissions can update service accounts to specific roles. - During role updates, verify that the caller possesses sufficient permissions to prevent unauthorized role updates. 3. Logging and Monitoring: - Log all role update operations, including the operator, timestamp, and details of the role change, to facilitate subsequent auditing and tracking. - Set up monitoring alerts to notify administrators promptly when anomalous role update operations are detected. Proof of Concept (POC) Code The following is a snippet of the corrected key code: ```python sky/users/permission.py def _maybe_initialize_policies(self) -> None: if policy_updated: enforcer.save_policy() def add_user_if_not_exists(self, user_id: str) -> None: """Add user role relationship.""" self._lazy_initialize() with policy.lock(): self._add_user_if_not_exists_no_lock(user_id) self._add_user_if_not_exists_no_lock(user_id, role) def update_role(self, user_id: str, new_role: str) -> None: self.invalidate_user_permission_cache(user_id) def get_user_roles(self, user_id: str) -> List[str]: """Get all roles for a user.""" return self._policy_lock().get_user_roles(user_id) def _policy_lock(self) -> Generator[None, None, None]: permission_service = PermissionService() with permission_service.policy_lock(): yield def seed_new_user_role(self, user_id: str) -> None: """Reload config, then set up policies for a newly-created user.""" self._reload_config() self._set_up_policies_for_new_user(user_id) def _set_up_policies_for_new_user(self, user_id: str) -> None: """Assigns the default role and grants any private-workspace access that the config's allowed_users lists over this user.""" self._assign_default_role(user_id) self._grant_private_workspace_access(user_id) def _assign_default_role(self, user_id: str) -> None: """Assigns the default role when omitted and grants any private-workspace access that the config's allowed_users lists over this user.""" self._assign_role(user_id, self._default_role) def _grant_private_workspace_access(self, user_id: str) -> None: """Refreshes the in-memory config first so a runtime change to rbac.default_role or workspaces is honored without a server restart.""" self._refresh_config() self._grant_workspace_access(user_id) def _refresh_config(self) -> None: """Refreshes the in-memory config first so a runtime change to rbac.default_role or workspaces is honored without a server restart.""" skyapi.config.safe_reload_config() def _grant_workspace_access(self, user_id: str) -> None: """Grants private-workspace access that the config's allowed_users lists over this user.""" self._grant_workspace_access_to_user(user_id) def _grant_workspace_access_to_user(self, user_id: str) -> None: """Grants private-workspace access that the config's allowed_users lists over this user.""" self._grant_workspace_access_to_user(user_id) def _assign_role(self, user_id: str, role: str) -> None: """Assigns the default role when omitted and grants any private-workspace access that the config's allowed_users lists over this user.""" self._assign_role_to_user(user_id, role) def _assign_role_to_user(self, user_id: str, role: str) -> None: """Assigns the default role when omitted and grants any private-workspace access that the config's allowed_users lists over this user.""" self._assign_role_to_user(user_id, role) def _assign_role_to_user(self, user_id: str, role: str) -> None: """Assigns the default role when omitted and grants any private-workspace access that the config's allowed_users lists over this user.""" self._assign_role_to_user(user_id, role) def _assign_role_to_user(self, user_id: str, role: str) -> None: """Assigns the default role when omitted and grants any private-workspace access that the co

Goal Reached Thanks to every supporter — we hit 100%!

SkyPilot Service Account Privilege Escalation via Insufficient Role Validation

More from this source