CVE-2022-39273 : Security Advisory and Response

FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte's authorization server without changing the default clientid hashes will be exposed to the public internet. In an effort to make enabling authentication easier for Flyte administrators, the default configuration for Flyte Admin allows access for Flyte Propeller even after turning on authentication via a hardcoded hashed password. This password is also set on the default Flyte Propeller configmap in the various Flyte Helm charts. Users who enable auth but do not override this setting in Flyte Admin's configuration may unbeknownst to them be allowing public traffic in by way of this default password with attackers effectively impersonating propeller. This only applies to users who have not specified the ExternalAuthorizationServer setting. Usage of an external auth server automatically turns off this default configuration and are not susceptible to this vulnerability. This issue has been addressed in version 1.1.44. Users should manually set the staticClients in the selfAuthServer section of their configuration if they intend to rely on Admin's internal auth server. Again, users who use an external auth server are automatically protected from this vulnerability.

Understanding CVE-2022-39273

FlyteAdmin is a platform for data processing. Enabling the default OAuth Authorization Server without changing hashes exposes users to the public internet. The vulnerability affects FlyteAdmin versions prior to 1.1.44.

What is CVE-2022-39273?

CVE-2022-39273 pertains to the default OAuth Authorization Server secret in FlyteAdmin, potentially allowing attackers to impersonate propeller due to a hardcoded hashed password vulnerability.

The Impact of CVE-2022-39273

The vulnerability could lead to unauthorized access to FlyteAdmin instances, enabling attackers to exploit the hardcoded hashed password for potential impersonation.

Technical Details of CVE-2022-39273

FlyteAdmin's vulnerability lies in the default OAuth Authorization Server configuration, specifically affecting versions below 1.1.44.

Vulnerability Description

The issue arises from the default configuration that could allow unauthorized access and potential impersonation due to hardcoded hashed passwords.

Affected Systems and Versions

FlyteAdmin versions prior to 1.1.44 are impacted by this vulnerability.

Exploitation Mechanism

Attackers could exploit the default hashed password to gain unauthorized access and impersonate propeller in FlyteAdmin instances.

Mitigation and Prevention

FlyteAdmin users are advised to take immediate steps to secure their instances and prevent unauthorized access.

Immediate Steps to Take

Users should update to version 1.1.44 or above and manually configure the staticClients in the selfAuthServer section to mitigate the vulnerability.

Long-Term Security Practices

Implement a secure authentication mechanism, avoid using default configurations, and regularly update FlyteAdmin for the latest security patches.

Patching and Updates

Users should update FlyteAdmin to version 1.1.44, set staticClients in the configuration, and consider using an external authentication server to enhance security.