CyberRota Analysis
AI-GeneratedKubernetes installations using OpenChoreo versions 1.2.0-rc.1 through 1.2.0 are vulnerable due to improper authorization in the exec and wirelogs handlers, allowing users with project-scoped grants to execute commands and access wirelogs from components across different projects within the same namespace. This can lead to unauthorized access and potential compromise of sensitive data. Organizations utilizing OpenChoreo in their Kubernetes environments should prioritize upgrading to version 1.2.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.2.0.