Multicluster Engine for Kubernetes vulnerabilities

In the cluster-proxy-addon component of Multicluster Engine for Kubernetes, an unauthenticated attacker with access to the user-facing route can bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster.

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.

In Multicluster Engine for Kubernetes images, the /etc/passwd file is created with group-writable permissions. An attacker with container access, even as non-root, who is a member of the root group can modify this file and add a user with any UID, including 0, gaining full root privileges in the container.