Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-46254
CVE-2023-46254:
capsule-proxy vulnerability analysis and mitigation
Overview
A bug in the RoleBinding reflector used by capsule-proxy, a reverse proxy for Capsule kubernetes multi-tenancy framework, was discovered affecting versions up to 0.4.4. The vulnerability allows ServiceAccount tenant owners to list Namespaces of other tenants that share the same owner kind and name, even though they should not have this access. This issue was disclosed on November 6, 2023, and has been assigned CVE-2023-46254 (Vendor Advisory).
Technical details
The vulnerability occurs when two conditions are met: capsule-proxy runs with --disable-caching=false (which is the default setting) and Tenant owners are ServiceAccounts with the same resource name but in different Namespaces. For example, if there are two tenants 'solar' and 'wind', each owned by a ServiceAccount named 'tenant-owner' in their respective namespaces, the tenant owner 'solar' can list the namespaces of tenant 'wind' and vice-versa. The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).
Impact
The vulnerability enables information exfiltration by allowing the listing of Namespace resources of other Tenants. However, it's important to note that this vulnerability does not allow any privilege escalation on the outer tenant Namespace-scoped resources, as the Kubernetes RBAC continues to enforce access controls (Vendor Advisory).
Mitigation and workarounds
This issue has been patched in version 0.4.5 of capsule-proxy. Users are advised to upgrade to this version or later. No alternative workarounds are available for this vulnerability (NVD).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management