Kyverno Outbound API Call Token Leakage Vulnerability in Admission Controller

A vulnerability exists in Kyverno's apiCall feature within ClusterPolicy, prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4. The issue arises because the feature automatically includes the admission controller's ServiceAccount token in outgoing HTTP requests to unvalidated URLs, which can be controlled by attackers. This token, when leaked, can be used to fully compromise a Kubernetes cluster by patching webhook configurations. The vulnerability is present in all Kyverno versions that support the apiCall service.

Impact

Exploitation of this vulnerability allows for the interception and unauthorized use of the admission controller's ServiceAccount token, leading to a complete compromise of the Kubernetes cluster.

Reproduction

To reproduce this vulnerability, create a ClusterPolicy that uses the apiCall feature to send a request to an external server. The request will include the admission controller's ServiceAccount token in the Authorization header. This can be verified by intercepting the request on the external server, which will receive the token. Once the token is captured, it can be used to patch webhook configurations, hijacking Kyverno's webhooks and intercepting API requests.

Remediation

Users can update to Kyverno versions 1.18.0-rc1, 1.17.2-rc1, or 1.16.4 to address this vulnerability.