Skip to content

Privilege Escalation in kubeoperator/kubepi

Critical
wanghe-fit2cloud published GHSA-757p-vx43-fp9r Jul 21, 2023

Package

No package listed

Affected versions

<= v1.6.4

Patched versions

v1.6.5

Description

Summary

A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request

PoC

Change the value of the isadmin field in the request to true:
https://drive.google.com/file/d/1e8XJbIFIDXaFiL-dqn0a0b6u7o3CwqSG/preview

Impact

Elevate user privileges

Severity

Critical
9.1
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
Low
Integrity
High
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

CVE ID

CVE-2023-37917

Weaknesses

No CWEs

Credits