CVE-2022-23652: Improper Authentication

February 23, 2022 (updated February 26, 2022)

capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious Connection header to start a privilege escalation attack towards the Kubernetes API Server. This vulnerability allows for an exploit of the cluster-admin Role bound to capsule-proxy. There are no known workarounds for this issue.

References

github.com/advisories/GHSA-9cwv-cppx-mqjm
github.com/clastix/capsule-proxy/commit/efe91f68ebf8a9e3d21491dc57da7b8a746415d8
github.com/clastix/capsule-proxy/issues/188
github.com/clastix/capsule-proxy/security/advisories/GHSA-9cwv-cppx-mqjm
nvd.nist.gov/vuln/detail/CVE-2022-23652

Code Behaviors & Features

Detect and mitigate CVE-2022-23652 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →