PipeCD Privilege Escalation Vulnerability via Service Account Token Access

A vulnerability in PipeCD versions through 0.49.3 allows attackers to access the service account's token due to insecure permissions. This access can lead to unauthorized privilege escalation. The vulnerability arises from incorrect access control, which could be exploited by malicious users to steal the ServiceAccount token. Once obtained, the token can be used to authenticate with the API Server, access all Secrets in the Kubernetes cluster, and potentially elevate privileges to take over the entire cluster.

Impact

Exploitation of this vulnerability could directly compromise all Secrets components in Kubernetes, allowing attackers to access sensitive information and escalate privileges, potentially leading to a takeover of the entire Kubernetes cluster.

Reproduction

To reproduce this vulnerability, a malicious user can exploit a DaemonSet in a project like HwameiStor, which has excessive permissions on node resources. By taking control of a worker node, the user can manipulate the DaemonSet to access the PipeCD pod with elevated permissions, steal the ServiceAccount token, and use it to authenticate with the API Server and access all Secrets in the cluster.