GitHub Advisoryadvisory · Go

GHSA-74j8-w7f9-pp62 Improper configuration of RBAC permissions obtaining cluster control permissions

CRITICAL Published 2023-06-30 Modified 2023-06-30 Official page ↗
Aliases
CVE-2023-33190
Ecosystem
Go
Packages
github.com/labring/sealos
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-863
Reviewed
2023-06-30

Affected packages

• Go github.com/labring/sealos: < 4.2.1-rc4 → fixed in 4.2.1-rc4

Description

Summary Improper configuration of RBAC permissions resulted in obtaining cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. Details detail's is disable by publish. PoC detail's is disable by publish. Impact + sealos public cloud user + CWE-287 Improper Authentication

Related

Alias · CVE (1)

  • CVE-2023-33190 Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-863 Incorrect Authorization weakness

References