T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/huawei_cloud/cce.py:3313- Finding
Cluster-Wide Kubernetes Secret Disclosure Through the Public CLI
- Content
View full analysis
Dict[str, Any]: return cce.list_cce_secrets( params["region"], params["cluster_id"], params.get("namespace"), _to_int(params.get("limit"), 100), params.get("include_data", "false").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id") ) ``` ```python # scripts/huawei_cloud/dispatcher.py:1514 "huawei_list_cce_secrets": ( ("region", "cluster_id"), _list_cce_secrets ), ``` ```python # scripts/huawei_cloud/cce.py:3398-3423 core_v1 = k8s_client.CoreV1Api() if namespace: secrets = core_v1.list_namespaced_secret(namespace, limit=limit) else: secrets = core_v1.list_secret_for_all_namespaces(limit=limit) secret_list = [] for secret in secrets.items: secret_info = { "name": secret.metadata.name, "namespace": secret.metadata.namespace, "type": secret.type, "created": str(secret.metadata.creation_timestamp) if secret.metadata.creation_timestamp else None, "labels": secret.metadata.labels, "annotations": secret.metadata.annotations, "data_keys": list(secret.data.keys()) if secret.data else [] } if include_data and secret.data: secret_info["data"] = secret.data secret_list.append(secret_info) ``` ### Technical Analysis The Skill declares a cost-optimization purpose centered on CCE inventory, utilization metrics, HPA analysis, and configuration recommendations. Reading Kubernetes Secret values is not required for those functions. The CLI nevertheless exposes `huawei_list_cce_secrets`. If the caller ...[truncated 2014 chars]- Remediation
View remediation