^{CVE-2021-43832:}Spinnaker vulnerability allows unauthorized pipeline creation and execution due to improper permissions, enabling remote code execution and unauthorized access to resources.

Overview

This vulnerability in Spinnaker allows unauthorized users to bypass authentication controls when creating and executing pipelines. The core issue is that the platform fails to properly enforce authentication requirements for these critical operations. When exploited, an attacker with access to the gate endpoint can create pipelines and execute them without having valid authentication credentials. In environments without properly configured RBAC, this vulnerability essentially provides an attacker with the ability to deploy arbitrary resources across any cloud account connected to the Spinnaker instance. This represents a significant security risk as it could lead to unauthorized resource provisioning, potential data exposure, and even complete compromise of cloud environments managed through Spinnaker.

Remediation

To address this vulnerability, users should take the following actions:

1. Upgrade to the latest releases of supported Spinnaker branches, which contain patches for this vulnerability.
2. If immediate upgrading is not possible, enable Role-based Access Control (RBAC) on ALL accounts and applications within Spinnaker to mitigate the ability of unauthorized pipelines to affect any accounts.
3. Block application access unless specific permissions are enabled.
4. Ensure ALL application creation is restricted via appropriate wildcards.
5. Audit existing pipelines and deployments to identify any potential unauthorized activities.
6. Review and strengthen authentication mechanisms across your Spinnaker deployment.
7. Consider implementing network-level controls to restrict access to Spinnaker's gate endpoint.

References

• GitHub Security Advisory: https://github.com/spinnaker/spinnaker/security/advisories/GHSA-9h7c-rfrp-gvgp
• CWE-306: Missing Authentication for Critical Function
• Spinnaker Security Documentation: https://spinnaker.io/docs/security/