Description (CNA)
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Kubernetes / Kubernetes Secrets Store CSI Driver | affected Vault Plugin before v0.0.6; affected Azure Plugin before v0.0.10; affected GCP Plugin before v0.2.0 |
CWE
CWE-24
References
- https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY
- https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384
ADP enrichment
No English description supplied.