Description (CNA)
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version 1.2.0, the `getSecretKey` template function, while introduced for senhasegura Devops Secrets Management (DSM) provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed in version 1.2.0, as everything done with that templating function can be done in a different way while respecting External Secrets Operator's safeguards As a workaround, use a policy engine such as Kubernetes, Kyverno, Kubewarden, or OPA to prevent the usage of `getSecretKey` in any ExternalSecret resource.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| external-secrets / external-secrets | affected >= 0.20.2, < 1.2.0 |
CWE
CWE-863
References
- https://github.com/external-secrets/external-secrets/security/advisories/GHSA-77v3-r3jw-j2v2
- https://github.com/external-secrets/external-secrets/issues/5690
- https://github.com/external-secrets/external-secrets/pull/3895
- https://github.com/external-secrets/external-secrets/commit/17d3e22b8d3fbe339faf8515a95ec06ec92b1feb
- https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in the External Secrets Operator. A user with appropriate permissions could exploit a vulnerability in the `getSecretKey` template function. This function allowed secrets, which are sensitive pieces of information like passwords or API keys, to be retrieved from other isolated environments (known as namespaces) within OpenShift Container Platform, bypassing security mechanisms. This could lead to unauthorized access and disclosure of sensitive data.