Execution with Unnecessary Privileges Affecting github.com/fission/fission/pkg/executor/executortype/newdeploy package, versions <1.23.0-rc1

Affected versions of this package are vulnerable to Execution with Unnecessary Privileges via the genDeploymentSpec and genDeploymentSpec pod construction paths in the newdeploy and generic pool components. An attacker can obtain the fission-fetcher service account token from the user-code container by supplying an environment PodSpec or patch that leaves the pod’s service account auto-mount enabled or adds a fetcher container mount at /var/run/secrets/kubernetes.io/serviceaccount. The affected function pods run with the fission-fetcher service account, so the injected token gives user code access to Kubernetes API credentials intended for the fetcher sidecar. In deployments that accept user-controlled pod spec overrides, this lets an attacker read cluster resources reachable by that service account and break isolation between the fetcher sidecar and the function container.

Workarounds

• Restrict who can create or update Function and Package CRDs in your cluster; treat the ability to ship function code as equivalent to namespace-wide secret read, which limits who can exploit the leaked service-account token.
• Reduce the fission-fetcher Role / ClusterRole scope where possible, for example by constraining it to specific named secrets via separate RoleBindings, which limits what the exposed token can read.
• Add NetworkPolicy egress rules that deny function pods access to the Kubernetes API server, which blunts the token even if it leaks into the user container.

• GitHub Advisory
• GitHub Commit
• GitHub PR