CVE-2024-9486

Use of Hard-coded Credentials (CWE-798)

Published: Oct 15, 2024 / Updated: 35d ago

010
CVSS 9.8EPSS 0.05%Critical
CVE info copied to clipboard

Summary

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.

Impact

This vulnerability allows attackers to gain unauthorized root access to affected Kubernetes nodes. The impact is severe, as it could lead to complete compromise of the affected nodes, potentially allowing attackers to execute arbitrary code, access sensitive data, or use the compromised nodes as a stepping stone for further attacks within the cluster. Given the CVSS base score of 9.8 (Critical), this vulnerability poses a significant risk to the confidentiality, integrity, and availability of affected systems.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Users should upgrade to Kubernetes Image Builder version > v0.1.37, which addresses this vulnerability.

Mitigation

1. Immediately upgrade Kubernetes Image Builder to a version higher than v0.1.37. 2. Rebuild all virtual machine images created with the vulnerable versions of Kubernetes Image Builder using the Proxmox provider. 3. Replace any nodes in Kubernetes clusters that were created using the affected images. 4. Implement strong access controls and network segmentation to limit potential damage if exploitation occurs. 5. Regularly audit and rotate credentials, especially for critical systems and components. 6. Monitor for any suspicious activities or unauthorized access attempts on Kubernetes nodes.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9486. See article

Oct 14, 2024 at 4:56 PM / r/kubernetes+openshift
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 14, 2024 at 4:56 PM
CVE Assignment

NVD published the first details for CVE-2024-9486

Oct 15, 2024 at 9:15 PM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 15, 2024 at 9:20 PM / nvd
Vendor Advisory

GitHub Advisories released a security advisory.

Oct 15, 2024 at 9:30 PM
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.4%)

Oct 16, 2024 at 11:00 AM
Threat Intelligence Report

CVE-2024-9486 is a critical vulnerability with a CVSS score of 9.8 that affects images built with the Proxmox provider, allowing attackers to gain root access to virtual machines by exploiting default credentials retained during the image build process. To mitigate this vulnerability, it is recommended to disable the “builder” account on affected virtual machines using the command ‘usermod -L builder’. There is no information provided regarding exploitation in the wild, proof-of-concept exploits, or downstream impacts on other third-party vendors. See article

Oct 16, 2024 at 11:07 AM
Vendor Advisory

RedHat CVE advisory released a security advisory (CVE-2024-9486).

Oct 16, 2024 at 6:30 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (5001297)

Oct 17, 2024 at 7:53 AM
Static CVE Timeline Graph

Affected Systems

Kubernetes/image_builder
+null more

Patches

bugzilla.redhat.com
+null more

Links to Mitre Att&cks

T1552.001: Credentials In Files
+null more

Attack Patterns

CAPEC-191: Read Sensitive Constants Within an Executable
+null more

Vendor Advisory

[GHSA-9224-ggvw-wh7v] VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder
GitHub Security Advisory: GHSA-9224-ggvw-wh7v Release Date: 2024-10-15 Update Date: 2024-10-17 Severity: Critical CVE-2024-9486 Base Score: 9.8 Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Package Information Package: github.com/kubernetes-sigs/image-builder Affected Versions: Patched Versions: 0.1.38 Description A security issue was discovered in the Kubernetes Image Builder versions References https://nvd.nist.gov/vuln/detail/CVE-2024-9486 kubernetes/kubernetes#128006 kubernetes-sigs/image-builder#1595 https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ

References

[Security Advisory] CVE-2024-9486 and CVE-2024-9594: VM images built with Kubernetes Image Builder use default credentials
Clusters using virtual machine images built with Kubernetes Image Builder ( GitHub - kubernetes-sigs/image-builder: Tools for building Kubernetes disk images ) version v0.1.37 or earlier are affected. VMs using images built with all other providers are not affected.
Kubernetes Image Builder Vulnerabilities
Certain image build providers did not disable default administrative credentials after the build process, allowing potential attackers root access to nodes after deployment in some cases. The vulnerabilities impact all versions of Image Builder up to and including Image Builder v0.1.37 when providers Proxmox (most severe), Nutanix, OVA, QEMU, and/or raw are utilized.
Critical Vulnerabilities Affecting GitHub Enterprise Server, Kubernetes Image Builder, and GiveWP Plugin
Recently, several critical vulnerabilities have been disclosed, affecting widely used platforms like GitHub Enterprise Server (GHES), Kubernetes Image Builder, and the GiveWP plugin for WordPress. The latest security update for GitHub Enterprise Server (GHES) addresses three newly discovered vulnerabilities, including a critical issue that could allow unauthorized access to the platform.
See 1 more references

News

SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2024:3911-1)
The remote SUSE host is missing one or more security updates. The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3911-1 advisory.
suse_linux SUSE-SU-2024:3911-1: SUSE SLES15 / openSUSE 15 : Security update for govulncheck-vulndb (Important) (SUSE-SU-2024:3911-1)
Testing Last Updated: 11/6/2024 CVEs: CVE-2024-49757 , CVE-2024-47182 , CVE-2024-8037 , CVE-2024-47827 , CVE-2024-8996 , CVE-2024-9264 , CVE-2024-47003 , CVE-2024-33662 , CVE-2024-47067 , CVE-2024-9180 , CVE-2024-49753 , CVE-2024-8038 , CVE-2024-9407 , CVE-2024-48921 , CVE-2024-47877 , CVE-2024-10214 , CVE-2023-32197 , CVE-2024-47832 , CVE-2024-8901 , CVE-2024-39223 , CVE-2024-9355 , CVE-2024-9313 , CVE-2024-8975 , CVE-2024-9341 , CVE-2024-36814 , CVE-2024-49381 , CVE-2024-22036 , CVE-2024-9486 , CVE-2024-47825 , CVE-2024-7558 , CVE-2023-22644 , CVE-2024-9594 , CVE-2024-47616 , CVE-2024-10241 , CVE-2024-49380 , CVE-2022-45157 , CVE-2024-38365 , CVE-2024-47534 , CVE-2024-48909 , CVE-2024-9312 , CVE-2024-7594 , CVE-2024-22030 , CVE-2024-9675 , CVE-2024-50312
Security: Mehrere Probleme in govulncheck-vulndb (SUSE)
* SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5
SUSE: 2024:3911-1 important: govulncheck-vulndb Security Advisory Updates
* jsc#PED-11136 Cross-References: * CVE-2022-45157 * CVE-2023-22644
openSUSE: 2024:3911-1: important: govulncheck-vulndb Security Advisory Update
This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z ( jsc#PED-11136 )
See 97 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI