CVE-2024-53350
📋 TL;DR
Insecure permissions in kubeslice v1.3.1 allow attackers to access service account tokens, enabling privilege escalation within Kubernetes clusters. This affects organizations using kubeslice for multi-cluster networking with the vulnerable version.
💻 Affected Systems
- kubeslice
📦 What is this software?
Kubeslice by Kubeslice
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain cluster-admin privileges, compromising all workloads, stealing sensitive data, and deploying malicious containers across connected clusters.
Likely Case
Attackers escalate privileges to access sensitive workloads, exfiltrate data, and potentially move laterally across connected Kubernetes clusters.
If Mitigated
Limited impact with proper network segmentation, RBAC restrictions, and service account token rotation policies in place.
🎯 Exploit Status
Requires initial access to Kubernetes cluster; exploitation involves accessing improperly secured service account tokens.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.3.2 or later
Vendor Advisory: https://github.com/kubeslice/kubeslice/security/advisories
Restart Required: No
Instructions:
1. Update kubeslice to v1.3.2 or later using helm upgrade. 2. Verify all kubeslice components are running the patched version.
🔧 Temporary Workarounds
Restrict Service Account Token Access
allManually adjust RBAC permissions to limit access to service account tokens
kubectl edit clusterrole kubeslice-controller
kubectl edit clusterrole kubeslice-worker
🧯 If You Can't Patch
- Implement strict network policies to isolate kubeslice components
- Regularly rotate service account tokens and audit RBAC permissions
🔍 How to Verify
Check if Vulnerable:
Check kubeslice version: kubectl get pods -n kubeslice-system -o jsonpath='{.items[*].spec.containers[*].image}' | grep -o 'kubeslice:[0-9.]*'Check Version:
kubectl get pods -n kubeslice-system -o jsonpath='{.items[*].spec.containers[*].image}'Verify Fix Applied:
Confirm all kubeslice pods show version 1.3.2 or higher in their image tags📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to service account token endpoints
- Unusual service account token usage patterns
Network Indicators:
- Unexpected API calls to Kubernetes token endpoints from unauthorized sources
SIEM Query:
source="kubernetes" AND ("serviceaccount/token" OR "secrets") AND action="get" AND user NOT IN [authorized_users]