Critical severity · published May 6, 2022
CVE-2022-24817
Flux2 is an open and extensible continuous delivery solution for Kubernetes
9.9
CVSS
1.1%
EPSS
No
On KEV
Description
Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Flux2 · Fluxcd
0.1.0 before 0.29.0 · source: NVD
HE
Helm-controller · Fluxcd
0.2.0 before 0.19.0 · source: NVD
KU
Kustomize-controller · Fluxcd
0.1.0 before 0.23.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24817
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24817
Patch
https://github.com/fluxcd/flux2/security/advisories/GHSA-vvmq-fwmg-2gjc
More from Flux2
8.8
CVE-2022-24877
Flux is an open and extensible continuous delivery solution for Kubernetes
7.8
CVE-2022-36035
Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), and automating updates to configuration when there is new code to…
7.5
CVE-2022-36049
Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage…
6.5
CVE-2022-24878
Flux is an open and extensible continuous delivery solution for Kubernetes
4.3
CVE-2022-39272
Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration