CyberRota Analysis
AI-GeneratedNuclio's Dashboard in Kubernetes versions 1.6.19 to before 1.17.2 is vulnerable due to improper sanitization of the spec.build.tempDir field, allowing users with function-create permissions to inject shell metacharacters and execute arbitrary commands within the Dashboard container. This vulnerability poses a significant risk as it enables unauthorized access to Kubernetes resources, including Secrets and Pods, through a service account with extensive permissions. Organizations using affected versions should prioritize upgrading to version 1.17.2 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permission can inject shell metacharacters into this field and achieve arbitrary command execution inside the Dashboard container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace. This issue has been patched in version 1.17.2.