Security fix (CVE-2018-18264) #3400

floreks · 2018-12-07T11:25:34Z

Skip option has been disabled by default and access to the Dashboard SA has been restricted to our backend only. In case user tries to send a request without auth info 401 error will be returned.

If user tries to "manually" skip login page by adding cookie in the frontend, every page that tries to access API server will look like that:

Thanks to #3077 most of the work has been already done.

floreks · 2018-12-07T11:26:52Z

@liggitt @bryk @maciaszczykm @jessfraz PTAL

maciaszczykm · 2018-12-07T11:54:25Z

Looks good to me. I will do some more testing tomorrow and if it is also okay with others let's make a release to solve this critical issue.

liggitt · 2018-12-07T14:46:27Z

src/app/backend/dashboard.go

@@ -66,7 +66,7 @@ var (
 	argMetricClientCheckPeriod   = pflag.Int("metric-client-check-period", 30, "Time in seconds that defines how often configured metric client health check should be run. Default: 30 seconds.")
 	argAutoGenerateCertificates  = pflag.Bool("auto-generate-certificates", false, "When set to true, Dashboard will automatically generate certificates used to serve HTTPS. Default: false.")
 	argEnableInsecureLogin       = pflag.Bool("enable-insecure-login", false, "When enabled, Dashboard login view will also be shown when Dashboard is not served over HTTPS. Default: false.")
-	argDisableSkip               = pflag.Bool("disable-skip", false, "When enabled, the skip button on the login page will not be shown. Default: false.")
+	argDisableSkip               = pflag.Bool("disable-skip", true, "When enabled, the skip button on the login page will not be shown. Default: false.")


change Default: false

the double negative makes this hard to follow... can the flag be changed to --enable-skip-login and default to false?

Sure we can but it also requires frontend and build pipeline refactoring. As skip option should be disabled by default then it is argDisableSkip=true.

I think we should do this anyways.

liggitt · 2018-12-07T15:08:14Z

src/app/backend/client/manager.go

@@ -279,6 +283,10 @@ func (self *clientManager) extractAuthInfo(req *restful.Request) (*api.AuthInfo,
 		return self.tokenManager.Decrypt(jweToken)
 	}



not knowing how this method is used, does returning nil,nil mean the service account credentials are used instead?

if so, shouldn't the if req == nil { case above return an error?

the "If request is nil then authentication will be skipped." comment on Client(req) sounds fragile (a call that doesn't pass in the request would escalate)

I actually investigated our code to check if it would be possible that external request comes as nil, and it is not. restful-go will always initialize request object for us. The first if req == nil is used to initialize insecureClient (by insecure I mean client that uses dashboard SA privileges) that is used internally by our backend only and return at the end is there, not to break dashboard in case someone chooses to actually set argDisableSkip to false.

I actually investigated our code to check if it would be possible that external request comes as nil, and it is not.

That may be true at this point in time, but a code path could be introduced that could call this with a nil internally as part of building a response to satisfy an external request.

The first if req == nil is used to initialize insecureClient (by insecure I mean client that uses dashboard SA privileges) that is used internally by our backend only

I'd like to see the internal client building made more separate from the function that is used to return clients used to handle external requests, for safety

liggitt · 2018-12-07T15:10:12Z

build/serve.js

@@ -79,6 +79,10 @@ function getBackendArgs(mode) {
    args.push(`--apiserver-host=${conf.backend.envApiServerHost || conf.backend.apiServerHost}`);
  }

+  if (!conf.backend.disableSkipButton) {


since undefined is falsy, would a missing config value re-enable the skip button? that seems fragile

This is only used by our development pipeline and can't actually affect anyone.

jessfraz · 2018-12-07T16:35:11Z

awesome thanks, agree with @liggitt above but ovverall really great thanks!

… code

floreks · 2018-12-08T16:03:48Z

Applied @liggitt 's suggestions and simplified our dev pipeline, not to break anything. To test it on serve/serve:prod use:
gulp serve:prod --serveHttps --autoGenerateCerts --enableSkipButton=false

liggitt

thanks for the updates. a couple more comments, then this looks good to me. note that I haven't swept all callers, or verified there are no code paths that use the internal client to look up data to serve external requests

liggitt · 2018-12-10T04:43:18Z

build/conf.js

+    /**
+     * Allows to override disable skip button option on the backend.
+     */
+    enableSkipButton: gulpUtil.env.enableSkipButton !== undefined ? gulpUtil.env.enableSkipButton :


simplify to gulpUtil.env.enableSkipButton === true?

The current one is actually correct as we need skip button to be enabled in our dev environments and tests by default. Most of our UI functionality tests rely on dashboard SA privileges.

It only affects our gulp serve, gulp serve:prod and tasks that rely directly on them, so tests mostly.

So in case someone simply uses gulp serve skip option will be visible. To disable it user will have to provide a enableSkipButton parameter. gulp serve --enableSkipButton=false.

would gulp serve or gulp serve:prod ever be used to actually run the dashboard?

@liggitt I don't think so. They are used only for manual tests before creating a PR or to check the changes. Also, they do not deploy container in the cluster but rather start a dashboard process outside of the cluster.

src/app/backend/args/builder.go

liggitt · 2018-12-10T04:46:04Z

src/app/backend/client/manager.go

@@ -279,6 +283,10 @@ func (self *clientManager) extractAuthInfo(req *restful.Request) (*api.AuthInfo,
 		return self.tokenManager.Decrypt(jweToken)
 	}



I actually investigated our code to check if it would be possible that external request comes as nil, and it is not.

That may be true at this point in time, but a code path could be introduced that could call this with a nil internally as part of building a response to satisfy an external request.

The first if req == nil is used to initialize insecureClient (by insecure I mean client that uses dashboard SA privileges) that is used internally by our backend only

I'd like to see the internal client building made more separate from the function that is used to return clients used to handle external requests, for safety

floreks · 2018-12-10T14:08:05Z

PTAL

codecov · 2018-12-11T09:11:29Z

Codecov Report

Merging #3400 into master will increase coverage by 0.06%.
The diff coverage is 70.49%.

@@            Coverage Diff             @@
##           master    #3400      +/-   ##
==========================================
+ Coverage    54.6%   54.66%   +0.06%     
==========================================
  Files         565      565              
  Lines       12434    12466      +32     
==========================================
+ Hits         6790     6815      +25     
- Misses       5382     5389       +7     
  Partials      262      262

Impacted Files	Coverage Δ
src/app/backend/client/manager.go	`64.15% <70.49%> (+3.85%)`	⬆️
src/app/backend/sync/secret.go	`66.94% <0%> (-2.55%)`	⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e4e81bf...b444f47. Read the comment docs.

floreks · 2018-12-11T10:24:29Z

@liggitt @maciaszczykm PTAL. Everything is green now, so if there are no more issues we could proceed with the release.

liggitt · 2018-12-12T18:37:51Z

src/app/backend/client/manager.go

+
+// Secure mode means that every request to Dashboard has to be authenticated and privileges
+// of Dashboard SA can not be used.
+func (self *clientManager) isSecureModeEnabled(req *restful.Request) bool {


this logic is extremely difficult to follow. can we do something like this as a first step to make sure this always returns true when skip login is not enabled?

if !args.Holder.GetEnableSkipLogin() { return true }

It would have to be a bit different actually.

if self.isLoginEnabled(req) && !args.Holder.GetEnableSkipLogin() { return true }

In case login option is completely disabled we can not block user out of Dashboard. First we have to make sure that it is enabled and then skip option has to be disabled. Bascially if we would split that then whole method would become:

func (self *clientManager) isSecureModeEnabled(req *restful.Request) bool { if self.isLoginEnabled(req) && !args.Holder.GetEnableSkipLogin() { return true } authInfo, _ := self.extractAuthInfo(req) return self.isLoginEnabled(req) && args.Holder.GetEnableSkipLogin() && authInfo != nil }

It might be slightly easier to follow. @liggitt WDYT?

that is simpler, but if I've configured the server to use TLS and not skip login, the incoming request shouldn't have any ability to make isSecureModeEnabled return false. Can we make the initial check only look at how the server was configured, not look at req?

Can we make the initial check only look at how the server was configured, not look at req?

It would make this method even more complicated as we have several arguments responsible for TLS mode. The easiest way is to check if req.Request.TLS != nil. If it is then we are sure that the request itself is secure.

There is no way to alter that from the outside. Only by corrupting restful-go used by dashboard someone would be able to somehow influence that.

Letting a characteristic of an incoming request control bypassing security seems like a bad idea when the intent to serve securely can be determined from the config options alone. I'd like to see that adjusted in the future.

maciaszczykm · 2018-12-13T08:55:44Z

Tested it locally on prod and it works as expected 👍

liggitt · 2018-12-14T07:52:29Z

/lgtm

This improves the current state, though the comments at https://github.com/kubernetes/dashboard/pull/3400/files#discussion_r241135916 are still relevant

k8s-ci-robot · 2018-12-14T07:52:47Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: floreks, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [floreks]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Sebastian Florek added 2 commits December 7, 2018 11:21

Disable skip option by default and forbid usage of Dashboard SA

fad0f25

Fix integration tests

c48efb9

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Dec 7, 2018

k8s-ci-robot requested review from cupofcat and rf232 December 7, 2018 11:25

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 7, 2018

floreks changed the title ~~Security fix~~ Security fix (CVE-2018-18264) Dec 7, 2018

Fix travis

5231c38

liggitt reviewed Dec 7, 2018

View reviewed changes

Sebastian Florek added 2 commits December 8, 2018 16:59

Change skip login option argument to 'enable-skip-login' and refactor…

31de9b7

… code

Refactor code

378fd99

Fix backend tests

53770f7

liggitt reviewed Dec 10, 2018

View reviewed changes

Split insecure/secure client creation logic for safety

28a1bfe

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Dec 10, 2018

Sebastian Florek added 2 commits December 11, 2018 08:40

Simplify secure client creation

6b8b6b4

Update karma conf for saucelabs

6ae0ab9

Add test

2e0f4f3

floreks force-pushed the security-fix branch from 1a377a8 to 2e0f4f3 Compare December 11, 2018 10:10

liggitt mentioned this pull request Dec 12, 2018

user without token have grant access kubernetes/kubernetes#71995

Closed

liggitt reviewed Dec 12, 2018

View reviewed changes

Refactor method to simplify logic

b444f47

maciaszczykm mentioned this pull request Dec 13, 2018

Prepare for 1.10.1 release #3414

Merged

floreks mentioned this pull request Dec 13, 2018

Help wanted: Trouble using custom SSL certificate with Dashboard #2995

Closed

k8s-ci-robot assigned liggitt Dec 14, 2018

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Dec 14, 2018

k8s-ci-robot merged commit 5abb13a into kubernetes:master Dec 14, 2018

maciaszczykm deleted the security-fix branch December 14, 2018 08:28

floreks mentioned this pull request Dec 28, 2018

Remove skip login option #2672

Closed

liggitt mentioned this pull request Jan 2, 2019

Bump dashboard to v1.10.1 kubernetes/kubernetes#72495

Merged

floreks mentioned this pull request Jan 4, 2019

Dashboard permission errors on upgrading to dashboard version 1.10.1 #3479

Closed

floreks mentioned this pull request May 6, 2020

Auth with Authorization header problem #5105

Closed

qpetraroia mentioned this pull request Oct 3, 2020

az aks dashboard is empty "There is nothing to display here" Azure/AKS#1573

Closed

tatianab mentioned this pull request Nov 8, 2023

x/vulndb: potential Go vuln in github.com/kubernetes/dashboard: CVE-2018-18264 golang/vulndb#2216

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security fix (CVE-2018-18264) #3400

Security fix (CVE-2018-18264) #3400

floreks commented Dec 7, 2018

floreks commented Dec 7, 2018

maciaszczykm commented Dec 7, 2018

liggitt Dec 7, 2018

liggitt Dec 7, 2018

floreks Dec 7, 2018

maciaszczykm Dec 7, 2018

liggitt Dec 7, 2018

liggitt Dec 7, 2018

floreks Dec 7, 2018 •

edited

Loading

liggitt Dec 10, 2018

liggitt Dec 7, 2018

floreks Dec 7, 2018

jessfraz commented Dec 7, 2018

floreks commented Dec 8, 2018

liggitt left a comment

liggitt Dec 10, 2018

floreks Dec 10, 2018

liggitt Dec 11, 2018

floreks Dec 11, 2018 •

edited

Loading

liggitt Dec 10, 2018

floreks commented Dec 10, 2018

codecov bot commented Dec 11, 2018 •

edited

Loading

floreks commented Dec 11, 2018 •

edited

Loading

liggitt Dec 12, 2018

floreks Dec 13, 2018

liggitt Dec 14, 2018 •

edited

Loading

floreks Dec 14, 2018

liggitt Dec 14, 2018

maciaszczykm commented Dec 13, 2018

liggitt commented Dec 14, 2018

k8s-ci-robot commented Dec 14, 2018

		@@ -279,6 +283,10 @@ func (self clientManager) extractAuthInfo(req restful.Request) (*api.AuthInfo,
		return self.tokenManager.Decrypt(jweToken)
		}

Security fix (CVE-2018-18264) #3400

Security fix (CVE-2018-18264) #3400

Conversation

floreks commented Dec 7, 2018

floreks commented Dec 7, 2018

maciaszczykm commented Dec 7, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

floreks Dec 7, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jessfraz commented Dec 7, 2018

floreks commented Dec 8, 2018

liggitt left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

floreks Dec 11, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

floreks commented Dec 10, 2018

codecov bot commented Dec 11, 2018 • edited Loading

Codecov Report

floreks commented Dec 11, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt Dec 14, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maciaszczykm commented Dec 13, 2018

liggitt commented Dec 14, 2018

k8s-ci-robot commented Dec 14, 2018

floreks Dec 7, 2018 •

edited

Loading

floreks Dec 11, 2018 •

edited

Loading

codecov bot commented Dec 11, 2018 •

edited

Loading

floreks commented Dec 11, 2018 •

edited

Loading

liggitt Dec 14, 2018 •

edited

Loading