Critical Kubernetes Image Builder Vulnerability Exposes Nodes to Root Access Risk
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-38139 | Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. NVD description · AI analysis pending | 8.8 | <1% |
| — | ||
| CVE-2024-38190 | Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector. Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector. NVD description · AI analysis pending | 8.6 | 1% |
| — | ||
| CVE-2024-38204 | Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network. Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network. NVD description · AI analysis pending | 6.5 | <1% |
| — | ||
| CVE-2024-45216 | Authentication Bypass in Apache Solr PKIAuthenticationPlugin (CVE-2024-45216) CVE-2024-45216 is a critical improper-authentication flaw (CVSS 9.8) in Apache Solr's PKIAuthenticationPlugin, which is enabled by default whenever Solr Authentication is configured. An attacker sends a request to any protected Solr API URL with a crafted fake ending that looks like an unprotected API path; Solr skips authentication for that request and then strips the fake ending before API routing, so the request is processed as the original protected path. This allows an unauthenticated attacker to reach Solr APIs that should require credentials, potentially exposing or modifying indexed data and configuration, with network access being the only prerequisite. Only Solr deployments that run Solr Authentication on versions 5.3.0 through 8.11.3 or 9.0.0 through 9.6.x are affected; unauthenticated Solr instances are not exposed to this bypass. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a 91.7% probability of exploitation within 30 days (100th percentile), so exploitation should be treated as likely imminent. Do: Upgrade to Apache Solr 9.7.0 or 8.11.4, which fix the issue. As an interim measure, disable the PKIAuthenticationPlugin or restrict network access to Solr with firewall/allowlist rules, and confirm whether your instances run Solr Authentication and are internet-exposed. Given the 91.7% EPSS, prioritize patching internet-facing Solr servers and review access logs for API requests bearing unusual URL suffixes that bypass authentication. | 9.8 | 92% |
| large≈20,000–50,000 internet-exposed Solr instances per public scans, with the directly vulnerable authenticated subset likely in the thousands to tens of thousands… | ||
| CVE-2024-9486 +1 in the same advisory: …9594 | A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider. NVD description · AI analysis pending | 9.8 group max | 2% |
| — |
Full article542 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 17, 2024Vulnerability / Kubernetes
A critical security flaw has been disclosed in the Kubernetes Image Builder that, if successfully exploited, could be abused to gain root access under certain circumstances.
The vulnerability, tracked as CVE-2024-9486 (CVSS score: 9.8), has been addressed in version 0.1.38. The project maintainers acknowledged Nicolai Rybnikar for discovering and reporting the vulnerability.
"A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the image build process," Red Hat's Joel Smith said in an alert.
"Additionally, virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access."
That having said, Kubernetes clusters are only impacted by the flaw if their nodes use virtual machine (VM) images created via the Image Builder project with the Proxmox provider.
As temporary mitigations, it has been advised to disable the builder account on affected VMs. Users are also recommended to rebuild affected images using a fixed version of Image Builder and redeploy them on VMs.
The fix put in place by the Kubernetes team eschews the default credentials for a randomly-generated password that's set for the duration of the image build. In addition, the builder account is disabled at the end of the image build process.
Kubernetes Image Builder version 0.1.38 also addresses a related issue (CVE-2024-9594, CVSS score: 6.3) concerning default credentials when image builds are created using the Nutanix, OVA, QEMU or raw providers.
The lower severity for CVE-2024-9594 stems from the fact that the VMs using the images built using these providers are only affected "if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring."
The development comes as Microsoft released server-side patches for three Critical-rated flaws Dataverse, Imagine Cup, and Power Platform that could lead to privilege escalation and information disclosure -
- CVE-2024-38139 (CVSS score: 8.7) - Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network
- CVE-2024-38204 (CVSS score: 7.5) - Improper Access Control in Imagine Cup allows an authorized attacker to elevate privileges over a network
- CVE-2024-38190 (CVSS score: 8.6) - Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector
It also follows the disclosure of a critical vulnerability in the Apache Solr open-source enterprise search engine (CVE-2024-45216, CVSS score: 9.8) that could pave the way for an authentication bypass on susceptible instances.
"A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path," a GitHub advisory for the flaw states. "This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing."
The issue, which affects Solr versions from 5.3.0 before 8.11.4, as well as from 9.0.0 before 9.7.0, have been remediated in versions 8.11.4 and 9.7.0, respectively.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/10/critical-kubernetes-image-builder.html