CVE-2022-24817: 
Flux Kustomize Controller vulnerability analysis and mitigation

Flux2, an open and extensible continuous delivery solution for Kubernetes, was found to contain a critical vulnerability (CVE-2022-24817) discovered in May 2022. The vulnerability affects Flux2 versions between 0.1.0 and 0.29.0, helm-controller versions 0.1.0 to v0.19.0, and kustomize-controller versions 0.1.0 to v0.23.0. This security issue involves improper kubeconfig validation that could allow arbitrary code execution (GitHub Advisory).

The vulnerability stems from Flux2's feature to reconcile the state of remote clusters using kubeconfig files with access rights. Kubeconfig files can define commands to be executed to generate on-demand authentication tokens. The issue lies in the fact that the use of executables in kubeconfigs was enabled by default, allowing malicious users to craft a kubeconfig that could lead to arbitrary code execution inside the controller's container. The vulnerability has been assigned a CVSS v3.1 base score of 9.9 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (GitHub Advisory).

The vulnerability could be exploited by users with either direct access to the cluster to create/modify Flux Kustomization or HelmRelease objects and Kubernetes Secrets, or access rights to make changes to a configured Flux Source. In multi-tenancy deployments, this vulnerability could lead to privilege escalation if the controller's service account has elevated permissions (GitHub Advisory).

To exploit this vulnerability, an attacker would need one of the following permissions: direct access to create Flux objects and Kubernetes Secrets, ability to modify existing Kubernetes secrets used as kubeconfig, or access to modify existing Flux objects combined with secret creation/modification rights. At the time of disclosure, there were no known public exploits in the wild (Kubernetes Discussion).

The vulnerability was fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0. The fix disables command execution from kubeconfig files by default, requiring users to explicitly opt-in using the --insecure-kubeconfig-exec flag. Temporary workarounds include using Validating Admission webhooks to restrict users from setting the spec.kubeConfig field in Flux objects, and applying restrictive AppArmor and SELinux profiles on the controller's pod to limit executable binaries (GitHub Advisory).