جزئیات آسیب‌پذیری

خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an authenticated user with delegated permission to manage a Project's `Roles` or `ServiceAccounts` confer permissions exceeding the user's own. A user authorized to edit `Roles` can create, replace, or add rules granting permissions not held by the user; a user authorized to edit a Role's ServiceAccount can bind an identity, including the user's own, to a more powerful Role. A Kargo Role comprises a `ServiceAccount, Role, and RoleBinding` in the Project namespace. Changes are written using the API server's broadly privileged credentials after only a coarse resource-kind edit check, rather than checking each permission being conferred. This permits escalation to Project-administrator access, disclosure of `Project Secrets` and credentials, and modification or deletion of Project resources. Stolen Git, container-registry, or Helm-registry credentials can extend confidentiality and integrity impacts to those external systems. Escalation remains limited to Projects where the attacker already has RBAC-management delegation and does not itself grant cluster-wide or cross-Project access. Default non-administrator roles do not permit these operations; exploitation requires an `administrator-created custom role` granting the relevant permissions and control of an account assigned that role. This issue is fixed in versions 1.8.14, 1.9.9, and 1.10.8.

• https://github.com/akuity/kargo/security/advisories/GHSA-wp4p-hr79-q4g8 x_refsource_CONFIRM
• https://github.com/akuity/kargo/commit/19639678811b486bddb014dabb25397771f3941e x_refsource_MISC
• https://github.com/akuity/kargo/commit/50d29c10153965114f903645c83eadbe7bf58d3f x_refsource_MISC
• https://github.com/akuity/kargo/commit/5ab7c4216a4151f55ea8ef9ff3b9f884dd322578 x_refsource_MISC
• https://github.com/akuity/kargo/commit/72fadd3600b35e6dce67042eb686720a48b45fa3 x_refsource_MISC
• https://github.com/akuity/kargo/releases/tag/v1.10.8 x_refsource_MISC
• https://github.com/akuity/kargo/releases/tag/v1.11.0-rc.1 x_refsource_MISC
• https://github.com/akuity/kargo/releases/tag/v1.8.14 x_refsource_MISC
• https://github.com/akuity/kargo/releases/tag/v1.9.9 x_refsource_MISC