Auth bypass in Clastix Capsule-Proxy
CVE-2023-48312
capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a missing check if the user is authenticated based on the `TokenReview` result. All the clusters running with the `anonymous-auth` Kubernetes API Server setting disable (set to `false`) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server. This privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS). This vulnerability has been addressed in version 0.4.6. Users are advised to upgrade.
Vulnerability class: Broken Authentication
EPSS: 0.006 (44.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Clastix Capsule-proxy
- Projectcapsule Capsule-proxy — versions < 0.4.6
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-48312?
- CVE-2023-48312 is a critical-severity vulnerability in Clastix Capsule-Proxy, classified under Improper Authentication. CVSS score: 9.8/10. Published 2023-11-24.
- How severe is CVE-2023-48312?
- Critical severity. CVSS v3 base score is 9.8 out of 10.