GHSA-c7xh-gjv4-4jgv: Github.com/kcp dev/kcp Kcp's Impersonation Allows Access To Vulnerability
MODERATEGHSA-c7xh-gjv4-4jgv is a MODERATE (CVSS 6.4) kcp's impersonation allows access to vulnerability (CWE-285: Improper Authorization) affecting Github.com/kcp dev/kcp libraries in the Go ecosystem. The issue involves kcp's impersonation allows access to global administrative groups. Remediation is available by upgrading affected packages to version 0.26.1.
GHSA-c7xh-gjv4-4jgv at a Glance
Security Impact
CVSS: 6.4
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
How to Fix GHSA-c7xh-gjv4-4jgv
To remediate this vulnerability, upgrade all affected Github.com/kcp dev/kcp dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/kcp-dev/kcp to 0.26.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/kcp-dev/kcpHow to Check if You Are Affected
To determine whether your application is affected by GHSA-c7xh-gjv4-4jgv, inspect your project dependencies for Github.com/kcp dev/kcp:
inspect dependencies for github.com/kcp-dev/kcpAnalyze the terminal output to locate any version of Github.com/kcp dev/kcp in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.26.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-285: Improper Authorization, where the product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. In Github.com/kcp dev/kcp, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-c7xh-gjv4-4jgv Affected Github.com/kcp dev/kcp Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/kcp-dev/kcp
|
Go |
< 0.26.1
|
0.26.1
|
References
Frequently Asked Questions
What is GHSA-c7xh-gjv4-4jgv?
Which Github.com/kcp dev/kcp versions are affected?
What version fixes GHSA-c7xh-gjv4-4jgv?
Is github.com/kcp-dev/kcp affected?
What is the CVSS score of GHSA-c7xh-gjv4-4jgv?
What CWE is associated with GHSA-c7xh-gjv4-4jgv?
How can I check Go dependencies for GHSA-c7xh-gjv4-4jgv?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-c7xh-gjv4-4jgv",
"modified" : "2024-12-12T19:33:14Z",
"published" : "2024-12-11T18:42:30Z",
"aliases" : [ ],
"summary" : "kcp's impersonation allows access to global administrative groups",
"details" : "### Impact\n\n[Impersonation](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation) is a feature of the Kubernetes API, allowing to override user information. As downstream project, kcp inherits this feature. As per the linked documentation a specific level of privilege (usually assigned to cluster admins) is required for impersonation.\n\nThe vulnerability in kcp affects kcp installations in which users are granted the `cluster-admin` ClusterRole (or comparably high permission levels that grant impersonation access; the verb in question is `impersonate`) within their respective workspaces. As kcp builds around self-service confined within workspaces, most installations would likely grant such workspace access to their users. Such users can impersonate special global administrative groups, which circumvent parts of the authorizer chains, e.g. [maximal permission policies](https://docs.kcp.io/kcp/v0.26/concepts/apis/exporting-apis/#maximal-permission-policy).\n\n### Patches\n\nThe problem has been patched in #3206 and is available in kcp 0.26.1 and higher.\n\n### Workarounds\n\n- Not assigning the `cluster-admin` role (or any other role granting blanket impersonation permissions) to users.\n- A reverse proxy between users and kcp to check for the `Impersonate-Group` header and reject requests that impersonate global administrative groups.\n\n### References\n\nSee the pull request (#3206).\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/kcp-dev/kcp"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.26.1"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 0.26.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/kcp-dev/kcp/security/advisories/GHSA-c7xh-gjv4-4jgv"
}, {
"type" : "WEB",
"url" : "https://github.com/kcp-dev/kcp/pull/3206"
}, {
"type" : "WEB",
"url" : "https://github.com/kcp-dev/kcp/commit/24ab5d4dc35ddff98a2e5fdc236e1681f03283ec"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/kcp-dev/kcp"
}, {
"type" : "WEB",
"url" : "https://pkg.go.dev/vuln/GO-2024-3325"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-285" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2024-12-11T18:42:30Z",
"nvd_published_at" : null
}
}