ghsa-c98h-7hp9-v9hq
Vulnerability from github
Published
2025-03-17 21:26
Modified
2025-03-19 14:59
Severity ?
6.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Summary
Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD
Details

Impact

The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3.

Baremetal Operator enables users to load Secret from arbitrary namespaces upon deployment of the namespace scoped Custom Resource BMCEventSubscription (BMCES). An adversary Kubernetes account with only namespace level roles (e.g. a tenant controlling a namespace) may create a BMCES in their authorized namespace and then load Secrets from their unauthorized namespaces to their authorized namespace via the Baremetal Operator controller's cluster scoped privileges, causing Secret leakage.

Patches

The patch makes BMO refuse to read Secrets from other namespace than where the corresponding Bare Metal Host (BMH) resource is. The patch does not change the BMCEventSubscription API in BMO, but stricter validation will deny the request at admission time. It will also prevent the controller reading such Secrets, in case the BMCES resource has already been deployed.

The issue exists for all versions of BMO, and is patched in BMO releases v0.9.1 and v0.8.1. Prior upgrading to patched BMO version, duplicate any existing Secret pointed to by BMCEventSubscription's httpHeadersRef to the same namespace where the corresponding BMH exists. After upgrade, remove the old Secrets.

Workarounds

Operator can configure BMO RBAC to be namespace scoped, instead of cluster scoped, to prevent BMO from accessing Secrets from other namespaces, and/or use WATCH_NAMESPACE configuration option to limit BMO to single namespace.

References

Credits

Metal3 Security Team thanks WHALEEYE and debuggerchen of Lab for Internet and Security Technology for responsible vulnerability disclosure.

Show details on source website

To clipboard 

{
   affected: [
      {
         package: {
            ecosystem: "Go",
            name: "github.com/metal3-io/baremetal-operator/apis",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0.9.0",
                  },
                  {
                     fixed: "0.9.1",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
         versions: [
            "0.9.0",
         ],
      },
      {
         database_specific: {
            last_known_affected_version_range: "<= 0.8.0",
         },
         package: {
            ecosystem: "Go",
            name: "github.com/metal3-io/baremetal-operator/apis",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     fixed: "0.8.1",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
   ],
   aliases: [
      "CVE-2025-29781",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-200",
         "CWE-653",
      ],
      github_reviewed: true,
      github_reviewed_at: "2025-03-17T21:26:14Z",
      nvd_published_at: "2025-03-17T22:15:14Z",
      severity: "MODERATE",
   },
   details: "### Impact\n\nThe Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. \n\nBaremetal Operator enables users to load Secret from arbitrary namespaces upon deployment of the namespace scoped Custom Resource `BMCEventSubscription` (BMCES). An adversary Kubernetes account with only namespace level roles (e.g. a tenant controlling a namespace) may create a BMCES in their authorized namespace and then load Secrets from their unauthorized namespaces to their authorized namespace via the Baremetal Operator controller's cluster scoped privileges, causing Secret leakage.\n\n### Patches\n\nThe patch makes BMO refuse to read Secrets from other namespace than where the corresponding Bare Metal Host (BMH) resource is. The patch does not change the `BMCEventSubscription` API in BMO, but stricter validation will deny the request at admission time. It will also prevent the controller reading such Secrets, in case the BMCES resource has already been deployed.\n\nThe issue exists for all versions of BMO, and is patched in BMO releases v0.9.1 and v0.8.1. Prior upgrading to patched BMO version, duplicate any existing Secret pointed to by `BMCEventSubscription`'s `httpHeadersRef` to the same namespace where the corresponding BMH exists. After upgrade, remove the old Secrets.\n\n### Workarounds\n\nOperator can configure BMO RBAC to be namespace scoped, instead of cluster scoped, to prevent BMO from accessing Secrets from other namespaces, and/or use `WATCH_NAMESPACE` configuration option to limit BMO to single namespace.\n\n### References\n\n- [patch to main](https://github.com/metal3-io/baremetal-operator/commit/19f8443b1fe182f76dd81b43122e8dd102f8b94c)\n- [patch to release-0.9](https://github.com/metal3-io/baremetal-operator/pull/2321)\n- [patch to release-0.8](https://github.com/metal3-io/baremetal-operator/pull/2322)\n- [BMCEventSubscription design document](https://github.com/metal3-io/metal3-docs/blob/main/design/baremetal-operator/bmc-events.md)\n\n### Credits\n\nMetal3 Security Team thanks [WHALEEYE](https://github.com/WHALEEYE) and [debuggerchen](https://github.com/debuggerchen) of [Lab for Internet and Security Technology](https://users.cs.northwestern.edu/~list/) for responsible vulnerability disclosure.",
   id: "GHSA-c98h-7hp9-v9hq",
   modified: "2025-03-19T14:59:19Z",
   published: "2025-03-17T21:26:14Z",
   references: [
      {
         type: "WEB",
         url: "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-c98h-7hp9-v9hq",
      },
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2025-29781",
      },
      {
         type: "WEB",
         url: "https://github.com/metal3-io/baremetal-operator/pull/2321",
      },
      {
         type: "WEB",
         url: "https://github.com/metal3-io/baremetal-operator/pull/2322",
      },
      {
         type: "WEB",
         url: "https://github.com/metal3-io/baremetal-operator/commit/19f8443b1fe182f76dd81b43122e8dd102f8b94c",
      },
      {
         type: "PACKAGE",
         url: "https://github.com/metal3-io/baremetal-operator",
      },
      {
         type: "WEB",
         url: "https://github.com/metal3-io/metal3-docs/blob/main/design/baremetal-operator/bmc-events.md",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
         type: "CVSS_V3",
      },
   ],
   summary: "Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD",
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.