T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/huawei_cloud/cce.py:3313- Finding
Dispatcher Can Return Cluster-Wide Kubernetes Secret Contents
- Content
View full analysis
Dict[str, Any]: return cce.list_cce_secrets(params["region"], params["cluster_id"], params.get("namespace"), _to_int(params.get("limit"), 100), params.get("include_data", "false").lower() == "true", params.get("ak"), params.get("sk"), params.get("project_id")) ``` ```python # scripts/huawei_cloud/dispatcher.py:1694 "huawei_list_cce_secrets": (("region", "cluster_id"), _list_cce_secrets), ``` ```python # scripts/huawei_cloud/cce.py:3404-3422 # List secrets core_v1 = k8s_client.CoreV1Api() if namespace: secrets = core_v1.list_namespaced_secret(namespace, limit=limit) else: secrets = core_v1.list_secret_for_all_namespaces(limit=limit) secret_list = [] for secret in secrets.items: secret_info = { "name": secret.metadata.name, "namespace": secret.metadata.namespace, "type": secret.type, "created": str(secret.metadata.creation_timestamp) if secret.metadata.creation_timestamp else None, "labels": secret.metadata.labels, "annotations": secret.metadata.annotations, "data_keys": list(secret.data.keys()) if secret.data else [] } if include_data and secret.data: secret_info["data"] = secret.data secret_list.append(secret_info) ``` ### Technical Analysis The public dispatcher registers `huawei_list_cce_secrets` and permits the caller to set `include_data=true`. When enabled, the implementation copies the complete `Secret.data` object into the returned JSON structure. The dispatcher subsequently serializes this structure to standard output. Kubernetes Secret values are base64-encoded rather than encrypted for AP ...[truncated 1932 chars]- Remediation
View remediation