CVE-2024-7557

A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, visible in the UI, can be utilized with oc --token={token} to exploit the elevated view privileges associated with the ServiceAccount, leading to unauthorized access to additional resources.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2024-7557	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2303094	Issue Tracking Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:openshift_ai:-:::::::*
	cpe:2.3:a:redhat:openshift_data_science:-:::::::*

History

No history.

Information

Published : 2024-08-12 13:38

Updated : 2024-09-18 07:15

NVD link : CVE-2024-7557

Mitre link : CVE-2024-7557

CVE.ORG link : CVE-2024-7557

JSON object : View

Products Affected

redhat

openshift_data_science
openshift_ai

CWE

CWE-284

Improper Access Control

NVD-CWE-Other

{"id": "CVE-2024-7557", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-08-12T13:38:43.727", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2024-7557", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2303094", "tags": ["Issue Tracking", "Permissions Required"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, visible in the UI, can be utilized with oc --token={token} to exploit the elevated view privileges associated with the ServiceAccount, leading to unauthorized access to additional resources."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en OpenShift AI que permite omitir la autenticaci\u00f3n y escalar privilegios entre modelos dentro del mismo espacio de nombres. Al implementar modelos de IA, la interfaz de usuario ofrece la opci\u00f3n de proteger los modelos con autenticaci\u00f3n. Sin embargo, las credenciales de un modelo se pueden utilizar para acceder a otros modelos y API dentro del mismo espacio de nombres. Los tokens de ServiceAccount expuestos, visibles en la interfaz de usuario, se pueden utilizar con oc --token={token} para explotar los privilegios de vista elevados asociados con ServiceAccount, lo que genera acceso no autorizado a recursos adicionales."}], "lastModified": "2024-09-18T07:15:04.293", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_ai:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EBF0A70A-E606-48C8-82C2-4D8760146265"}, {"criteria": "cpe:2.3:a:redhat:openshift_data_science:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3F5FF1E-5DA3-4EC3-B41A-A362BDFC4C69"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}