CVE-2021-34824 repro

reproducing an old istio bug

This set of scripts and manifests will aid in exploring an old Istio security issue which allowed malicious Istio users to access Kubernetes secrets they should not have access to. This reproduction is modeled on this blog post which has some problems. See this blog post for details.

Using

See the vulnerability

1. Run ./one_time_setup.sh to download the necessary binaries.
2. Run ./deploy_test.sh to deploy the vulnerable version of istio in a vulnerable configuration.
3. Run ./evaluate_test.sh to examine the results of the test.

See the fix

1. Edit istio_versions.sh and switch the ISTIO_VERSION variable from ${ISTIO_VULN} to ${ISTIO_SAFE}.
2. Run ./deploy_test.sh to deploy the fixed version of istio in the same vulnerable configuration.
3. Run ./rollpods.sh to bounce the gateway pods so they pick up the new version.
4. Run ./check_version.sh to verify that the fixed version of istio is running.
5. Run ./evaluate_test.sh to examine the results again.