kubernetes-sigs image-builder Proxmox Provider default credentials

Summaryinfo

A vulnerability identified as very critical has been detected in kubernetes-sigs image-builder. This issue affects some unknown processing of the component Proxmox Provider. Performing a manipulation results in default credentials. This vulnerability is reported as CVE-2024-9486. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as very critical, was found in kubernetes-sigs image-builder (affected version not known). This affects some unknown functionality of the component Proxmox Provider. The manipulation with an unknown input leads to a default credentials vulnerability. CWE is classifying the issue as CWE-1392. The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.

The advisory is shared at seclists.org. This vulnerability is uniquely identified as CVE-2024-9486 since 10/03/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/09/2024).

The vulnerability scanner Nessus provides a plugin with the ID 210390 (SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2024:3911-1)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (210390). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Virtualization Software

Vendor

• kubernetes-sigs

Name

• image-builder

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion