projectcapsule capsule-proxy up to 0.4.4 RoleBinding Reflector information disclosure

Summaryinfo

A vulnerability was found in projectcapsule capsule-proxy up to 0.4.4 and classified as problematic. The impacted element is an unknown function of the component RoleBinding Reflector. Executing a manipulation can lead to information disclosure. This vulnerability is registered as CVE-2023-46254. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in projectcapsule capsule-proxy up to 0.4.4 (Firewall Software) and classified as problematic. This vulnerability affects an unknown code of the component RoleBinding Reflector. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

capsule-proxy is a reverse proxy for Capsule kubernetes multi-tenancy framework. A bug in the RoleBinding reflector used by `capsule-proxy` gives ServiceAccount tenant owners the right to list Namespaces of other tenants backed by the same owner kind and name. For example consider two tenants `solar` and `wind`. Tenant `solar`, owned by a ServiceAccount named `tenant-owner` in the Namespace `solar`. Tenant `wind`, owned by a ServiceAccount named `tenant-owner` in the Namespace `wind`. The Tenant owner `solar` would be able to list the namespaces of the Tenant `wind` and vice-versa, although this is not correct. The bug introduces an exfiltration vulnerability since allows the listing of Namespace resources of other Tenants, although just in some specific conditions: 1. `capsule-proxy` runs with the `--disable-caching=false` (default value: `false`) and 2. Tenant owners are ServiceAccount, with the same resource name, but in different Namespaces. This vulnerability doesn't allow any privilege escalation on the outer tenant Namespace-scoped resources, since the Kubernetes RBAC is enforcing this. This issue has been addressed in version 0.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was published 11/07/2023 as GHSA-6758-979h-249x. The advisory is available at github.com. This vulnerability was named CVE-2023-46254 since 10/19/2023. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

Upgrading to version 0.4.5 eliminates this vulnerability. Applying the patch 615202f7b02eaec7681336bd63daed1f39ae00c5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Firewall Software

Vendor

• projectcapsule

Name

• capsule-proxy

Version

• 0.4.0
• 0.4.1
• 0.4.2
• 0.4.3
• 0.4.4

License

• open-source

Website

• Product: https://github.com/projectcapsule/capsule-proxy/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion