Description

Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR

Summary:

A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges.

Details:

The EventSource and Sensor CRs allow the corresponding orchestrated pod to be customized with spec.template and spec.template.container (with type k8s.io/api/core/v1.Container), thus, any specification under container such as command, args, securityContext , volumeMount can be specified, and applied to the EventSource or Sensor pod due to the code logic below.

    if args.EventSource.Spec.Template != nil && args.EventSource.Spec.Template.Container != nil {
        if err := mergo.Merge(&eventSourceContainer, args.EventSource.Spec.Template.Container, mergo.WithOverride); err != nil {
            return nil, err
        }
    }

With these, A user would be able to gain privileged access to the cluster host, if he/she specified the EventSource/Sensor CR with some particular properties under template.

Here is an example that demonstrates the vulnerability.

apiVersion: argoproj.io/v1alpha1
kind: EventSource
metadata:
  name: poc-vulnerable-eventsource
spec:
  webhook:
    security-test:
      port: "12000"...
Show more

Impact:

Multi-tenant Clusters:

Tenant isolation broken

Non-admin users can gain host/cluster access

Access to other tenants' data

Security Model Bypass:

RBAC restrictions circumvented

Pod Security Policies/Standards bypassed

Host system compromised

Patches

A patch for this vulnerability has been released in the following Argo Events version , which only limited properties under spec.template.container are allowed.

v1.9.6

Credits

This vulnerability was found & reported by:

@thevilledev

The Argo team would like to thank him for his responsible disclosure and constructive communications during the resolve of this issue.

Mitigation

Aliases

References