Improper Access Control in spinnaker
CVE-2021-43832

10CRITICAL

Key Information:

Vendor

Spinnaker

Status
Spinnaker
Vendor
CVE Published:
4 January 2022

What is CVE-2021-43832?

Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup Role-based access control (RBAC) with-in spinnaker, this enables remote execution and access to deploy almost any resources on any account. Patches are available on the latest releases of the supported branches and users are advised to upgrade as soon as possible. Users unable to upgrade should enable RBAC on ALL accounts and applications. This mitigates the ability of a pipeline to affect any accounts. Block application access unless permission are enabled. Users should make sure ALL application creation is restricted via appropriate wildcards.

Affected Version(s)

spinnaker >= 1.26.0, < 1.26.7 < 1.26.0, 1.26.7

spinnaker < 1.25.8 < 1.25.8

References

https://github.com/spinnaker/spinnaker/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.