CVE-2024-42480
📋 TL;DR
Kamaji versions 1.0.0 and earlier have an RBAC misconfiguration that allows Kubernetes control plane API servers to access and manipulate data from other control planes. This affects all deployments using vulnerable Kamaji versions for hosted Kubernetes control planes. The vulnerability stems from overly permissive etcd role definitions.
💻 Affected Systems
- Kamaji (Hosted Control Plane Manager for Kubernetes)
📦 What is this software?
Kamaji by Clastix
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all Kubernetes control planes managed by Kamaji, allowing attackers to read, modify, or delete sensitive cluster data across multiple tenants.
Likely Case
Unauthorized cross-tenant data access between control planes, potentially exposing sensitive configuration, secrets, or cluster state information.
If Mitigated
Limited impact with proper network segmentation and access controls, though the vulnerability still exists at the RBAC level.
🎯 Exploit Status
Exploitation requires access to a control plane API server but leverages built-in RBAC permissions. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: edge-24.8.2
Vendor Advisory: https://github.com/clastix/kamaji/security/advisories/GHSA-6r4j-4rjc-8vw5
Restart Required: Yes
Instructions:
1. Update Kamaji to version edge-24.8.2 or later. 2. Restart all Kamaji components. 3. Verify RBAC configurations are properly scoped.
🔧 Temporary Workarounds
Manual RBAC Correction
linuxManually adjust etcd role definitions to use properly scoped resource names instead of open ranges
kubectl edit clusterrole kamaji-etcd-role
kubectl edit clusterrole kamaji-etcd-lease-role
🧯 If You Can't Patch
- Implement strict network segmentation between control plane etcd instances
- Apply additional layer of authentication/authorization between control planes
🔍 How to Verify
Check if Vulnerable:
Check Kamaji version and review etcd role definitions for open range patterns in RBAC rulesCheck Version:
kubectl get deployment -n kamaji-system kamaji-controller-manager -o jsonpath='{.spec.template.spec.containers[0].image}'Verify Fix Applied:
Verify Kamaji version is edge-24.8.2+ and etcd roles use properly scoped resource names📡 Detection & Monitoring
Log Indicators:
- Unauthorized etcd access attempts across control plane boundaries
- Unexpected etcd operations from non-owner control planes
Network Indicators:
- Cross-control-plane etcd traffic that shouldn't exist
- Unexpected etcd port connections between control planes
SIEM Query:
source="etcd" AND (operation="PUT" OR operation="DELETE" OR operation="GET") AND NOT dest_control_plane=source_control_plane