Authentication Bypass and Privilege Escalation Vulnerability in OpenShift AI
CVE-2024-7557

8.8HIGH

Key Information:

Status
Red Hat Openshift Ai (rhoai)
Red Hat Openshift Data Science (rhods)
Vendor
CVE Published:
12 August 2024

What is CVE-2024-7557?

In OpenShift AI, a vulnerability exists that permits authentication bypass and privilege escalation across models within the same namespace. This concern arises during AI model deployment, where the user interface allows the configuration of authentication for models. Unfortunately, tokens from one model are inadvertently usable for accessing other models and APIs within the same namespace. The vulnerability is exacerbated by the exposure of ServiceAccount tokens in the UI, enabling malicious users to exploit these tokens through commands like 'oc --token={token}', thereby gaining unauthorized access to resources and elevating privileges significantly.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://access.redhat.com/security/cve/CVE-2024-7557
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2303094
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Adam Bellusci (RedHat) for reporting this issue.
JSON
.