CVE-2023-30512: CubeFS allows Kubernetes cluster-level privilege escalation

April 12, 2023

CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets, including the admin secret.

References

github.com/advisories/GHSA-9337-8c6c-c2xg
github.com/cubefs/cubefs/issues/1882
nvd.nist.gov/vuln/detail/CVE-2023-30512

Detect and mitigate CVE-2023-30512 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →