Anthony Weems

CVE-2021-25746: Ingress-nginx directive injection via annotations

Fri, 22 Apr 2022 00:00:00 +0000

A user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

CVE-2022-21496: Improper Implementation of the LDAP URI Specification Allowing for Host Validation Bypasses

Tue, 19 Apr 2022 00:00:00 +0000

A parser differential between com.sun.jndi.ldap.LdaoURL and java.net.URI may lead to LDAP URI validation bypasses.

CVE-2022-21701: Istio Privileged Escalation in Kubernetes Gateway API

Tue, 18 Jan 2022 00:00:00 +0000

Istio version 1.12.0 and 1.12.1 are vulnerable to a privilege escalation attack. Users who have CREATE permission for gateways.gateway.networking.k8s.io objects can escalate this privilege to create other resources that they may not have access to, such as Pod.

Remote code execution in Managed Anthos Service Mesh control plane

Fri, 15 Oct 2021 02:18:00 +0600

Vulnerability Details The following writeup describes a vulnerability that allows remote code execution on the Istio control plane. However, this vulnerability requires high privilege access to the Kubernetes cluster in which Istio is deployed. This would normally be a low / informational risk vulnerability, but in a managed Istio context, it becomes higher risk. To demonstrate, I focused on the Google-managed Anthos Service Mesh (ASM), which runs the Istio control plane in a Google-managed project using a per-product per-project service account (P4SA) that authenticates to the user’s GKE cluster.

GKE Autopilot Node Compromise via Race Condition

Thu, 01 Apr 2021 17:48:00 +0600

Vulnerability Details GKE Autopilot provides many default security controls to protect the node, including protections against privileged pods and limitations on hostPath volume mounts. There is a race condition during provisioning of the Autopilot OPA policies that allows an attacker to bypass the intended controls by simply creating their malicious resource while the OPA policies are being provisioned. To demonstrate, use the following steps: Download the file deploy.yaml Create an Autopilot cluster While the cluster is being created, run the following commands (replacing $name): while true; do gcloud container clusters get-credentials $name && break; done while true; do timeout 1 kubectl apply -f deploy.

GKE Autopilot Node Compromise via SSH Metadata

Fri, 05 Mar 2021 16:22:00 +0600

Vulnerability Details GKE Autopilot provides many default security controls to protect the node, including protections against privileged pods and limitations on hostPath volume mounts. The nodes are configured to pull from the compute metadata SSH keys list. As documented here, a user with compute.projects.setCommonInstanceMetadata can set project-wide SSH keys. To prevent users from simply logging in to the nodes directly, the nodes use an sshd configuration to set all user shells to /sbin/nologin.

GKE Autopilot Node Compromise via startup-script

Fri, 05 Mar 2021 16:22:00 +0600

Vulnerability Details GKE Autopilot provides many default security controls to protect the node, including protections against privileged pods and limitations on hostPath volume mounts. The Autopilot nodes do not have a startup-script defined in their instance metadata. As documented here, a user with compute.projects.setCommonInstanceMetadata can set a project-wide startup script. Since the nodes do not have this attribute set, they will use the project-wide attribute and allow arbitrary code execution from the startup-script.

GKE Autopilot Node Compromise via local-storage PersistentVolume

Mon, 01 Mar 2021 03:14:00 +0600

Vulnerability Details GKE Autopilot provides many default security controls to protect the node, including protections against privileged pods and limitations on hostPath volume mounts. However, these security configurations did not prevent PersistentVolumes with the “local-storage” storage class. The “local-storage” class can be used to mount files from the node into a pod, similar to hostPath volume mounts. This can be abused to mount sensitive files/directories from the node into a pod and elevate permissions.

Github Secrets exposed due to RCE in Formatter Action from pull_request_target event

Thu, 17 Dec 2020 15:12:00 +0600

Vulnerability Details The formatter action is triggered on pull_request_target events, which run with the context of the base repository and is therefore allowed to mount secrets. However, the formatter action specifically checks out the reference from the Pull Request (which is attacker controlled code). This breaks the security benefits of pull_request_target and exposes secrets to the attack code. This might be acceptable when the action does not allow for code exec.

Cross-tenant Cloud Function compromise via storage bucket squatting

Sun, 20 Sep 2020 01:33:00 +0600

Vulnerability Details Google Cloud Functions accept code from users and build this code into a deployable container via Cloud Build. Before building, the code is uploaded to a cloud storage bucket whose name matches the format gcf-sources-<numeric-project-id>-<location> (e.g. gcf-sources-928967777810-us-central1). When uploading user provided code to the gcf-sources bucket, the backend does not verify that the bucket owner matches the current project. As the bucket name is not a domain, nor does it contain the word Google, an attacker can register these scratch buckets for any target accounts.

Remote code execution in import image task via storage bucket squatting

Sat, 19 Sep 2020 21:10:00 +0600

Vulnerability Details gcloud has subcommands for importing/exporting compute images. These commands create Cloud Build tasks which launch an instance in your project to perform the import/export task. They use the open source GoogleCloudPlatform/compute-image-tools repo to execute these workflows. Both workflows use a “scratch” storage bucket for storing logs, scratch data, and startup scripts. The bucket name formats are below: export: "<project-id>-daisy-bkt-us" import: "<project-id>-daisy-bkt" If this bucket does not exist, it creates it within the user’s project, otherwise, it simply attempts to write to the bucket.

Site Isolation bypass via Chrome extension

Wed, 27 Nov 2019 15:08:00 +0600

Vulnerability Details This vulnerability assumes a compromise of the renderer process as described in this post: https://groups.google.com/a/chromium.org/forum/#!msg/chromium-extensions/0ei-UCHNm34/IDaXwQhzBAAJ From a compromised renderer process, we can send a message to the extension background script (chext_backgroundpage.js) and break site isolation by triggering a POST request with credentials to an arbitrary origin, with arbitrary headers, and the ability to read the response. Steps to reproduce: Install the Google Input Tools extension: https://chrome.google.com/webstore/detail/google-input-tools/mclfklkfljcocdinagocijmpgbhab Visit an “attacker” domain (e.

CVE-2019-18818: strapi Password Reset Auth Bypass

Thu, 07 Nov 2019 00:00:00 +0000

strapi before 3.0.0-beta.17.5 mishandles password resets within default authentication controllers.

v1 Instance Metadata Service protections bypass

Fri, 14 Jun 2019 14:35:00 +0600

The Instance Metadata Service has protections against server-side request forgery. This vulnerability describes a bypass for these protections due to URL parsing issues.

CVE-2019-1003040: Jenkins Script Security plugin sandbox escape

Thu, 28 Mar 2019 00:00:00 +0000

Sandbox projection in the “Script Security and Pipeline: Groovy Plugins” could be circumvented through methods supporting type casts and type coercion. This allowed attackers to invoke constructors for arbitrary types.

CVE-2018-2813: MySQL Missing Privilege Check

Fri, 15 Dec 2017 00:00:00 +0000

Privilege escalation in MySQL server due to a missing file permission check.

CVE-2016-7063: Pritunl Privilege Escalation via Path Traversal

Tue, 23 Aug 2016 00:00:00 +0000

The Pritunl Client service accepted configuration data which was saved to a file. The service, running as root, would write user specified data to the user specified path, leading to privilege escalation.

CVE-2016-7064: Pritunl Invalid Signature Verification

Tue, 23 Aug 2016 00:00:00 +0000

The Pritunl Client did not validate VPN server certificates before initiating a VPN connection.

CVE-2016-4991: Command injection in NodePDF

Tue, 24 May 2016 00:00:00 +0000

NodePDF passes filenames to child_process.exec(), however, it does not properly encode all special characters.

CVE-2015-5238: Stack overflow in libtre5

Wed, 01 Jul 2015 00:00:00 +0000

A buffer overflow exists in tre_parse() when parsing a literal (e.g. \x{deadbeef}), used during regular expression compilation.