Chaos Mesh Chaos Controller Manager Unauthenticated GraphQL Debugging Server Vulnerability Leading to Cluster-Wide Denial of Service

A denial-of-service vulnerability has been identified in the Chaos Controller Manager component of Chaos Mesh. The issue arises because the manager exposes a GraphQL debugging server without authentication, accessible to the entire Kubernetes cluster. This server provides an API that can be used to terminate arbitrary processes in any Kubernetes pod, potentially causing widespread disruption across the cluster.

Impact

Exploitation of this vulnerability can lead to a cluster-wide denial-of-service condition, where processes in Kubernetes pods can be arbitrarily terminated, causing disruptions in services and applications running within the cluster.

Remediation

Users are advised to update to Chaos Mesh version 2.7.3 or later, where this vulnerability has been addressed. The official Chaos Mesh GitHub repository contains the latest release information and update instructions.