CVE-2022-23652
In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious `Connection` header to start a privilege escalation attack towards the Kubernetes API Server.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious `Connection` header to start a privilege escalation attack towards the Kubernetes API Server. This vulnerability allows for an exploit of the `cluster-admin` Role bound to `capsule-proxy`. There are no known workarounds for this issue.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.40% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- clastix/capsule-proxy
- Source
- security-advisories@github.com
References
- https://github.com/clastix/capsule-proxy/commit/efe91f68ebf8a9e3d21491dc57da7b8a746415d8Patch, Third Party Advisory
- https://github.com/clastix/capsule-proxy/issues/188Exploit, Issue Tracking, Third Party Advisory
- https://github.com/clastix/capsule-proxy/security/advisories/GHSA-9cwv-cppx-mqjmThird Party Advisory
- https://github.com/clastix/capsule-proxy/commit/efe91f68ebf8a9e3d21491dc57da7b8a746415d8Patch, Third Party Advisory
- https://github.com/clastix/capsule-proxy/issues/188Exploit, Issue Tracking, Third Party Advisory
- https://github.com/clastix/capsule-proxy/security/advisories/GHSA-9cwv-cppx-mqjmThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.