T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/analyzers/secret.py:41
- Finding
- Namespace-Scoped Analysis Retrieves and Caches Secrets from All Readable Namespaces## Vulnerability Details **File Location**: `scripts/analyzers/secret.py:41-61`; related caching behavior in `scripts/core/base.py:511-572` **Vulnerability Type**: Excessive Kubernetes Secret access and sensitive-data retention **Risk Level**: High ### Vulnerable Code ```python secrets = self._list_resources_paginated( list_func=v1.list_secret_for_all_namespaces, cache_key="secrets", namespace=namespace, label_selector=label_selector ) # 获取所有Pod以检查Secret使用情况 pods = self._list_resources_paginated( list_func=v1.list_pod_for_all_namespaces, cache_key="pods", namespace="", label_selector="" ) used_secrets = self._get_used_secrets(pods) for secret in secrets: if namespace and secret.metadata.namespace != namespace: continue ``` The shared pagination helper retains the complete API response objects: ```python full_cache_key = f"{cache_key}:{namespace}:{label_selector}" cached = self._get_cached(full_cache_key) if cached is not None: self._logger.debug(f"使用缓存数据: {full_cache_key}") return cached all_items = [] continue_token = None total_count = 0 iteration = 0 max_iterations = PERF_CONFIG["max_iterations"] while iteration < max_iterations: iteration += 1 try: if continue_token: response = list_func( limit=limit, _continue=continue_token, label_selector=label_selector if label_selector else None, _request_timeout=self._timeout ) else: response = list_func( limit=limit, label_selector=label_selector if label_selector else None, _request_timeout=self._timeout ) items = response.items if hasattr(response, 'items') else response if not isinstance(items, list): items = [items] if items else [] ...[truncated 2831 chars]
- Remediation
- ## Remediation Suggestions 1. When a namespace is supplied, invoke the namespaced Kubernetes API: ```python if namespace: list_func = lambda **kwargs: v1.list_namespaced_secret( namespace=namespace, **kwargs ) else: list_func = v1.list_secret_for_all_namespaces ``` 2. Avoid caching complete Kubernetes Secret objects. Disable caching for the Secret analyzer or immediately reduce each object to non-sensitive fields such as: - Name - Namespace - Secret type - Data key names - Presence or absence of required fields 3. Explicitly discard Secret values after inspection and ensure they are never included in logs, exceptions, reports, or serialized diagnostic results. 4. Split cache storage by sensitivity and prohibit Secret objects from entering the shared global resource cache. 5. Document and provide a minimal Kubernetes RBAC policy. Prefer namespace-specific Roles and RoleBindings over a cluster-wide Secret-list permission. 6. If cluster-wide Secret analysis is explicitly requested, require clear caller confirmation and disclose that Secret objects from all authorized namespaces will be accessed.