{"schema_version":"1.9.0","id":"GHSA-mg7w-c9x2-xh7r","published":"2025-01-03T16:12:03Z","modified":"2025-01-07T16:27:08.171935Z","aliases":["CVE-2024-56513","GO-2025-3364"],"summary":"Karmada PULL Mode Cluster Privilege Escalation","details":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThe [PULL](https://karmada.io/docs/next/userguide/clustermanager/cluster-registration#pull-mode) mode clusters registered with the `karmadactl register` command have excessive privileges to access control plane resources. By abusing these permissions, an attacker able to authenticate as the karmada-agent to a karmada cluster would be able to obtain administrative privileges over the entire federation system including all registered member clusters.\n\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nSince Karmada v1.12.0, command `karmadactl register` restricts the access permissions of pull mode member clusters to control plane resources. This way, an attacker able to authenticate as the karmada-agent cannot control other member clusters in Karmada.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nRestricts the access permissions of pull mode member clusters to control plane resources according to [Karmada Component Permissions Docs](https://karmada.io/docs/administrator/security/component-permission).\n### References\n_Are there any links users can visit to find out more?_\n 1. Enhancements made from the Karmada community: https://github.com/karmada-io/karmada/pull/5793\n 2. Karmada Component Permissions: https://karmada.io/docs/administrator/security/component-permission\n","affected":[{"package":{"name":"github.com/karmada-io/karmada","ecosystem":"Go","purl":"pkg:golang/github.com/karmada-io/karmada"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-mg7w-c9x2-xh7r/GHSA-mg7w-c9x2-xh7r.json"}}],"references":[{"type":"WEB","url":"https://github.com/karmada-io/karmada/security/advisories/GHSA-mg7w-c9x2-xh7r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56513"},{"type":"WEB","url":"https://github.com/karmada-io/karmada/pull/5793"},{"type":"WEB","url":"https://github.com/karmada-io/karmada/commit/2c82055c4c7f469411b1ba48c4dba4841df04831"},{"type":"PACKAGE","url":"https://github.com/karmada-io/karmada"},{"type":"WEB","url":"https://karmada.io/docs/administrator/security/component-permission"}],"database_specific":{"cwe_ids":["CWE-266"],"github_reviewed":true,"github_reviewed_at":"2025-01-03T16:12:03Z","nvd_published_at":"2025-01-03T17:15:08Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}