CVE-2024-46528: IDOR security vulnerability

[wansir]

CVSS Rating: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Recently, security researchers from a third-party platform discovered an Insecure Direct Object Reference (IDOR) vulnerability in the open-source versions of KubeSphere 3.4.1 and 4.1.1. This vulnerability allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks. We promptly contacted the team and assisted them in resolving the issue. Detailed information about the CVE vulnerability and the resolution process can be found in the following links:

CVE-2024-46528
IDOR Vulnerability in KubeSphere

Am I vulnerable?

The vulnerability allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks, but this data cannot be directly exploited to cause significant impact.

Affected Versions

KubeSphere 4.x affected versions: < 4.1.3
KubeSphere 3.x affected versions: >= 3.0.0, <= 3.4.1
KubeSphere Enterprise 4.x affected versions: < 4.1.3
KubeSphere Enterprise 3.x affected versions: >= 3.0.0, <= 3.5.0

How do I mitigate this vulnerability?

Remove unnecessary resource permissions from the authenticated platform role.

kubectl patch globalrole.iam.kubesphere.io authenticated --type merge -p '{"rules": [{"apiGroups":["monitoring.kubesphere.io","metering.kubesphere.io","monitoring.coreos.com"],"resources":["cluster"],"verbs":["list"]},{"apiGroups":["resources.kubesphere.io"],"resources":["clusters"],"verbs":["get","list"]}]}'

Acknowledgements

This vulnerability was reported by Okan Kurtuluş.

/area security
/kind bug