A potential risk of operator makes a worker node get the token of any Service Account

[sparkEchooo]

The Deployment named "cluster-manager" uses a ServiceAccount with the same name ("cluster-manager"). This ServiceAccount is bound to a ClusterRole also named "cluster-manager," which includes the permission to create Pod resources.

Therefore, if this Deployment runs a pod on an attacker-controlled node, the attacker can obtain the cluster-manager's token and steal any sa's token by creating and mounting target sa. And even control the whole cluster.

[sparkEchooo]

Klusterlet has the same problem, even more serious.
(getSecrets、createSecrets)

[qiujian16]

thanks for the reporting. the code has been moved to https://github.com/open-cluster-management-io/ocm

[sparkEchooo]

Thanks for your reply!
The fixes is effective.
By the way, if it's a real issue and has been fixed, can I get a CVE-number:)
Looking forward to your reply!

[qiujian16]

cc @mikeshng

[dhaiducek]

cc @pshickeydev

[sparkEchooo]

Knock knock! Are there any updates?Looking forward to your reply! @pshickeydev @mikeshng

[pshickeydev]

Hi @sparkEchooo, thanks for bringing this to our attention! We're taking a look at this and will let you know what our assessment is. Once again, thank you for your report and I hope to get back to you soon!

[sparkEchooo]

I'm looking forward your reply. And there are some similar CVE for your reference.

CVE-2023-30512(https://nvd.nist.gov/vuln/detail/CVE-2023-30512)
CVE-2023-30617(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30617)
CVE-2023-26484(kubevirt/kubevirt#9109)
CVE-2023-30840(https://nvd.nist.gov/vuln/detail/CVE-2023-30840)

Thanks again.

[sparkEchooo]

Hi@pshickeydev
I apologize for any inconvenience. How is the progress coming along? Looking forward to your reply!

[sparkEchooo]

Hi there, how's the progress going.
Could I know the result.
:)