CyberRota Analysis
AI-GeneratedA vulnerability exists in the Data Science Pipelines Operator that allows namespace editors to inject malicious parameters into the MySQL Data Source Name (DSN) string, potentially enabling the LOCAL INFILE functionality. This exploitation can lead to the exfiltration of sensitive files, including service account tokens, resulting in privilege escalation to cluster-admin status. Organizations utilizing the Data Science Pipelines Operator should prioritize addressing this vulnerability to safeguard their Kubernetes environments.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name (DSN) string. By manipulating these parameters, an attacker can enable LOCAL INFILE functionality and exfiltrate sensitive files, such as the service account token, from the operator pod. This can lead to privilege escalation, allowing a namespace editor to gain cluster-admin privileges.