Summary
Kyverno's generate-rule admission checks can rely on the background controller's permissions rather than the permissions of the user who authored a policy. A namespace administrator may therefore create a namespaced Policy that causes the controller to generate or clone resources in other namespaces or at cluster scope, exceeding the administrator's RBAC permissions.
Kyverno's generate-rule admission checks can rely on the background controller's permissions rather than the permissions of the user who authored a policy. A namespace administrator may therefore create a namespaced Policy that causes the controller to generate or clone resources in other namespaces or at cluster scope, exceeding the administrator's RBAC permissions.
Affected context
The issue affects Kyverno deployments before 1.19.2 where namespace administrators can create namespaced Policies containing generate rules. Risk arises when admission checks validate the controller's permissions without adequately constraining the policy author's authority or the target resource scope.
The issue affects Kyverno deployments before 1.19.2 where namespace administrators can create namespaced Policies containing generate rules. Risk arises when admission checks validate the controller's permissions without adequately constraining the policy author's authority or the target resource scope.
Exploit preconditions
- Attack surface: Admission of namespaced Kyverno Policies with generate rules
- Required access: Ability to create a Policy in a namespace, such as through namespace-admin permissions
- Trigger point: Policy admission followed by background-controller processing
- Why exploitation is possible: The checks may verify the controller's permissions instead of ensuring the author is authorized to request the target resource and scope
- Attack surface: Admission of namespaced Kyverno Policies with generate rules
- Required access: Ability to create a Policy in a namespace, such as through namespace-admin permissions
- Trigger point: Policy admission followed by background-controller processing
- Why exploitation is possible: The checks may verify the controller's permissions instead of ensuring the author is authorized to request the target resource and scope
Why this happens
The authorization decision for generated resources is not sufficiently bound to the identity and permissions of the policy author. By relying on the background controller's broader privileges, Kyverno can allow a lower-privileged user to cause actions beyond their own authorization. This is a privilege-management weakness mapped to CWE-269: Improper Privilege Management.
The authorization decision for generated resources is not sufficiently bound to the identity and permissions of the policy author. By relying on the background controller's broader privileges, Kyverno can allow a lower-privileged user to cause actions beyond their own authorization. This is a privilege-management weakness mapped to CWE-269: Improper Privilege Management.
Potential impact
- Namespace administrators could cause resources to be created or cloned in other namespaces
- Policies could result in unauthorized changes to cluster-scoped resources
- An attacker could gain influence over workloads or configuration beyond their authorized scope
- The broader impact could depend on the permissions and resources available to the background controller
- Namespace administrators could cause resources to be created or cloned in other namespaces
- Policies could result in unauthorized changes to cluster-scoped resources
- An attacker could gain influence over workloads or configuration beyond their authorized scope
- The broader impact could depend on the permissions and resources available to the background controller
General mitigation guidance
Defensive patterns focus on ensuring policy authors cannot indirectly exercise privileges held by a controller.
- Authorize requested target resources and scopes against the policy author's permissions, not only the controller's
- Constrain namespaced policies to appropriate namespace-scoped targets unless elevated authority is explicitly granted
- Use narrowly scoped service accounts and least-privilege permissions for background controllers
- Apply clear administrative boundaries and review controls for policies that can generate or clone resources
- Treat policy definitions as security-sensitive inputs and reduce who can create or modify them
Defensive patterns focus on ensuring policy authors cannot indirectly exercise privileges held by a controller.
- Authorize requested target resources and scopes against the policy author's permissions, not only the controller's
- Constrain namespaced policies to appropriate namespace-scoped targets unless elevated authority is explicitly granted
- Use narrowly scoped service accounts and least-privilege permissions for background controllers
- Apply clear administrative boundaries and review controls for policies that can generate or clone resources
- Treat policy definitions as security-sensitive inputs and reduce who can create or modify them
How teams detect issues like this
- Review authorization logic to confirm that policy authors' identities and permissions are considered for generated resources
- Use static analysis and code review to identify checks that authorize actions solely through a privileged controller identity
- Audit namespaced Policies for generate rules targeting other namespaces or cluster-scoped kinds
- Monitor policy admission and controller activity for generated resources outside the policy's namespace or expected scope
- Enforce policy and RBAC rules that restrict cross-namespace and cluster-scoped generation
- Review authorization logic to confirm that policy authors' identities and permissions are considered for generated resources
- Use static analysis and code review to identify checks that authorize actions solely through a privileged controller identity
- Audit namespaced Policies for generate rules targeting other namespaces or cluster-scoped kinds
- Monitor policy admission and controller activity for generated resources outside the policy's namespace or expected scope
- Enforce policy and RBAC rules that restrict cross-namespace and cluster-scoped generation
