CyberRota Analysis
AI-GeneratedThe vulnerability affects the Kubernetes provider in Prowler versions prior to 5.36.0, where the connection test improperly processes kubeconfig_content with a legacy GCP auth-provider, allowing an attacker to execute arbitrary commands via subprocess.Popen. This critical flaw poses a severe risk as it could lead to unauthorized command execution on shared worker environments, potentially compromising the entire Kubernetes cluster. Organizations utilizing Prowler for cloud security should prioritize upgrading to version 5.36.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfig_contains_exec_auth in api/src/backend/api/v1/serializers.py checked only exec blocks, and POST /api/v1/providers/{id}/connection loaded it through config.load_kube_config_from_dict in prowler/providers/kubernetes/kubernetes_provider.py, causing kubernetes-python CommandTokenSource.token to run the attacker-supplied command through subprocess.Popen on the shared worker. This issue is fixed in version 5.36.0.