OpenShift Container Platform Environment Variable Injection Vulnerability in Docker Builds

A vulnerability exists in the OpenShift Container Platform build system, allowing users with the 'edit' ClusterRole to inject arbitrary environment variables into 'docker-build' containers via the 'buildconfigs/instantiate' API. This issue, stemming from an incomplete fix for a prior vulnerability, could lead to information disclosure by manipulating build traffic confidentiality.

Impact

Exploitation of this vulnerability could result in unauthorized injection of environment variables, potentially leading to information disclosure by intercepting and manipulating build traffic.

Reproduction

The vulnerability can be reproduced by a user with the 'edit' ClusterRole. Inject arbitrary environment variables, such as 'LD_PRELOAD' or 'http_proxy', into 'docker-build' containers through the 'buildconfigs/instantiate' API. The environment variable injection will propagate to the 'docker-build' container, which remains privileged.