x/vulndb: potential Go vuln in github.com/clusternet/clusternet: CVE-2023-30622

[GoVulnBot]

CVE-2023-30622 references github.com/clusternet/clusternet, which may be a Go module.

Description:
Clusternet is a general-purpose system for controlling Kubernetes clusters across different environments. An issue in clusternet prior to version 0.15.2 can be leveraged to lead to a cluster-level privilege escalation. The clusternet has a deployment called cluster-hub inside the clusternet-system Kubernetes namespace, which runs on worker nodes randomly. The deployment has a service account called clusternet-hub, which has a cluster role called clusternet:hub via cluster role binding. The clusternet:hub cluster role has "*" verbs of "*.*" resources. Thus, if a malicious user can access the worker node which runs the clusternet, they can leverage the service account to do malicious actions to critical system resources. For example, the malicious user can leverage the service account to get ALL secrets in the entire cluster, resulting in cluster-level privilege escalation. Version 0.15.2 contains a fix for this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-30622
• JSON: https://github.com/CVEProject/cvelist/tree/cb281cc0c992f4de3967862855a73c4afd857c8b/2023/30xxx/CVE-2023-30622.json
• advisory: GHSA-833c-xh79-p429
• web: https://github.com/clusternet/clusternet/releases/tag/v0.15.2
• Imported by: https://pkg.go.dev/github.com/clusternet/clusternet?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/clusternet/clusternet
    packages:
      - package: clusternet
description: |
    Clusternet is a general-purpose system for controlling Kubernetes clusters across different environments. An issue in clusternet prior to version 0.15.2 can be leveraged to lead to a cluster-level privilege escalation. The clusternet has a deployment called `cluster-hub` inside the `clusternet-system` Kubernetes namespace, which runs on worker nodes randomly. The deployment has a service account called `clusternet-hub`, which has a cluster role called `clusternet:hub` via cluster role binding. The `clusternet:hub` cluster role has `"*" verbs of "*.*"` resources. Thus, if a malicious user can access the worker node which runs the clusternet, they can leverage the service account to do malicious actions to critical system resources. For example, the malicious user can leverage the service account to get ALL secrets in the entire cluster, resulting in cluster-level privilege escalation. Version 0.15.2 contains a fix for this issue.
cves:
  - CVE-2023-30622
references:
  - advisory: https://github.com/clusternet/clusternet/security/advisories/GHSA-833c-xh79-p429
  - web: https://github.com/clusternet/clusternet/releases/tag/v0.15.2

[zpavlinovic]

The project seems to define a binary. The fixes are in the packages that are not imported by anyone. The APIs of the project define just types without methods and functions.

[gopherbot]

Change https://go.dev/cl/488455 mentions this issue: data/excluded: batch add GO-2023-1735

[gopherbot]

Change https://go.dev/cl/592760 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606785 mentions this issue: data/reports: unexclude 20 reports (5)