CVE-2024-3744: azure-file-csi-driver discloses service account tokens in logs #124759
Labels
area/security
committee/security-response
Denotes an issue or PR intended to be handled by the product security committee.
kind/bug
Categorizes issue or PR as related to a bug.
lifecycle/frozen
Indicates that an issue or PR should not be auto-closed due to staleness.
official-cve-feed
Issues or PRs related to CVEs officially announced by Security Response Committee (SRC)
sig/auth
Categorizes an issue or PR as relevant to SIG Auth.
triage/accepted
Indicates an issue or PR is ready to be actively worked on.
CVSS Rating: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - MEDIUM (6.5)
A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.
This issue has been rated MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (6.5), and assigned CVE-2024-3744
Am I vulnerable?
You may be vulnerable if TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.
To check if token requests are configured, run the following command:
kubectl get csidriver file.csi.azure.com -o jsonpath="{.spec.tokenRequests}"
To check if tokens are being logged, examine the secrets-store container log:
kubectl logs csi-azurefile-controller-56bfddd689-dh5tk -c azurefile -f | grep --line-buffered "csi.storage.k8s.io/serviceAccount.tokens"
Affected Versions
How do I mitigate this vulnerability?
Prior to upgrading, this vulnerability can be mitigated by running azure-file-csi-driver at log level 0 or 1 via the -v flag.
Fixed Versions
To upgrade, refer to the documentation: https://github.com/kubernetes-sigs/azurefile-csi-driver?tab=readme-ov-file#install-driver-on-a-kubernetes-cluster
Detection
Examine cloud provider logs for unexpected token exchanges, as well as unexpected access to cloud resources.
If you find evidence that this vulnerability has been exploited, please contact [email protected]
Acknowledgements
This vulnerability was patched by Weizhi Chen @cvvz from Microsoft.
Thank You,
Rita Zhang on behalf of the Kubernetes Security Response Committee
/triage accepted
/lifecycle frozen
/area security
/kind bug
/committee security-response
The text was updated successfully, but these errors were encountered: