CVE-2021-41254: 
Flux Kustomize Controller vulnerability analysis and mitigation

kustomize-controller is a Kubernetes operator specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes manifests and assembled with Kustomize. A critical vulnerability (CVE-2021-41254) was discovered that allows users with permissions to create Kubernetes Secrets, Service Accounts, and Flux Kustomization objects to execute commands inside the kustomize-controller container by embedding shell scripts in Kubernetes Secrets. This vulnerability was discovered through a security audit conducted by ADA Logics, sponsored by CNCF and facilitated by OSTIF, and was fixed in kustomize-controller v0.15.0 (included in flux2 v0.18.0) released on October 8, 2021 (GitHub Advisory).

The vulnerability has a CVSS v3.1 base score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerability allows attackers to execute kubectl commands under the Service Account of kustomize-controller by creating a secret with embedded shell commands, linking it to a Service Account, and then creating a Kustomization that runs under that Service Account (GitHub Advisory).

The vulnerability primarily affects multitenant environments where non-admin users have permissions to create Flux Kustomization objects. Successful exploitation allows an authenticated Kubernetes user to gain cluster admin privileges, effectively compromising the entire cluster's security (GitHub Advisory).

The vulnerability can be exploited through a three-step process: 1) Creating a secret with a shell command, 2) Creating a Service Account that references this secret, and 3) Creating a Kustomization that runs under the created Service Account. When kustomize-controller reconciles the Kustomization, it executes the shell command from the secret (GitHub Advisory).

The vulnerability was patched in kustomize-controller v0.15.0 (included in flux2 v0.18.0). The fix removes the ability to execute shell commands on the container OS and removes the kubectl binary from the container image. As a workaround, organizations can use Kubernetes validation webhooks such as Gatekeeper OPA or Kyverno to prevent the creation of Kubernetes Service Accounts with secrets in namespaces owned by tenants (GitHub Advisory).