CVE-2024-37307

Executive Summary

CVE-2024-37307 is a high-severity information disclosure vulnerability affecting Cilium, a networking, observability, and security solution with an eBPF-based dataplane. The vulnerability resides in the cilium-bugtool debugging utility. When invoked with the --envoy-dump flag against a Cilium deployment that has the Envoy proxy enabled, the tool collects and outputs sensitive cryptographic material and API keys into a bug report archive.

The exposed data includes CA certificates, certificate chains, and private keys used for TLS inspection, Ingress/Gateway API TLS termination, and API keys used in Kafka-related network policies. This vulnerability is particularly dangerous because it can lead to a complete compromise of encrypted traffic inspection capabilities and authentication mechanisms if the bug report archive is mishandled or exfiltrated.

The vulnerability affects all Cilium versions from 1.13.0 up to, but not including, the patched versions (1.13.17, 1.14.12, 1.15.6). The EPSS score is 0.0%, indicating that exploitation is not currently widespread, but the potential impact is severe.

Supply Chain & Package Security

Cilium is distributed as a container image and via Helm charts. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core binary. However, organizations using Cilium as part of their Kubernetes supply chain should verify the version of Cilium deployed in their clusters. The cilium-bugtool binary is included in the Cilium agent container image. Any CI/CD pipeline or incident response process that automatically collects bug reports from Cilium clusters should be reviewed to ensure that the --envoy-dump flag is not used, or that the output is handled with extreme care.

CVSS Breakdown & Threat Level

CVSS Score: 7.9 (High) Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

• Attack Vector (AV): Local (L) – The attacker must have local access to the system where cilium-bugtool is executed, or the output archive must be exfiltrated.
• Attack Complexity (AC): Low (L) – No special conditions are required to exploit the vulnerability beyond running the tool with the flag.
• Privileges Required (PR): High (H) – The user running cilium-bugtool typically requires root or high-level privileges within the cluster.
• User Interaction (UI): None (N) – The vulnerability is triggered by the tool itself, not by user interaction with a malicious payload.
• Scope (S): Changed (C) – The compromised resource (the bug report archive) can affect the security of the entire Cilium cluster (e.g., TLS keys can be used to decrypt traffic).
• Confidentiality (C): High (H) – Sensitive cryptographic material and API keys are exposed.
• Integrity (I): None (N) – The vulnerability does not allow modification of data.
• Availability (A): None (N) – The vulnerability does not affect availability.

Threat Level: High. While the attack vector is local, the potential for lateral movement and data compromise is significant. An attacker who gains access to a bug report archive can decrypt TLS traffic, impersonate services, and access Kafka clusters.

Deep Dive & Mechanics

The vulnerability is rooted in the cilium-bugtool utility, which is designed to collect debugging information from a Cilium cluster. When the --envoy-dump flag is provided, the tool queries the Envoy proxy's administrative interface to retrieve its configuration. Envoy's admin interface, by default, exposes the full configuration, including TLS certificates and private keys, as well as any API keys configured for Kafka network policies.

The cilium-bugtool tool does not sanitize or filter the output from the Envoy admin interface. It simply dumps the entire configuration into the bug report archive. This archive is typically a tarball that can be shared with support teams or developers for debugging purposes.

The sensitive data is exposed in the following contexts:

• TLS Inspection: The CA certificate, certificate chain, and private key used for decrypting and inspecting TLS traffic.
• Ingress/Gateway API with TLS Termination: The TLS certificates and private keys used for terminating TLS at the ingress gateway.
• Kafka Network Policies with API Key Filtering: The API keys used to authenticate with Kafka clusters.

An attacker who obtains the bug report archive can:

1. Decrypt all TLS traffic that was being inspected by Cilium.
2. Impersonate any service that uses TLS termination via Cilium Ingress/Gateway API.
3. Authenticate to Kafka clusters using the exposed API keys.

Vulnerable vs. Patched Code

The vulnerability is not in a specific code snippet but in the design of the cilium-bugtool utility. The patched versions (1.13.17, 1.14.12, 1.15.6) implement filtering to redact sensitive information from the Envoy dump before including it in the bug report archive.

Vulnerable Behavior (Pre-Patch):

// Pseudocode for vulnerable cilium-bugtool
func collectEnvoyDump() {
    config := envoyAdmin.GetConfigDump() // Returns full config including secrets
    archive.AddFile("envoy_config.json", config)
}

Patched Behavior (Post-Patch):

// Pseudocode for patched cilium-bugtool
func collectEnvoyDump() {
    config := envoyAdmin.GetConfigDump()
    redactedConfig := redactSensitiveFields(config) // Removes TLS keys, certs, API keys
    archive.AddFile("envoy_config.json", redactedConfig)
}

The patch introduces a redaction function that identifies and removes or masks fields containing sensitive data, such as tls_certificates, private_key, api_key, etc.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Cilium cluster (version 1.13.0 to 1.15.5) with Envoy proxy enabled.
• Ability to execute cilium-bugtool with the --envoy-dump flag (requires high privileges, typically root or cluster-admin).

Exploitation Steps:

1. Identify Target: Find a Cilium pod in the cluster.

   kubectl get pods -n kube-system | grep cilium
   

2. Execute Bugtool with Envoy Dump:

   kubectl exec -n kube-system <cilium-pod> -- cilium-bugtool --envoy-dump
   

3. Retrieve the Archive: The tool outputs a tarball file (e.g., cilium-bugtool-<timestamp>.tar.gz). Copy it to your local machine.

   kubectl cp kube-system/<cilium-pod>:/tmp/cilium-bugtool-<timestamp>.tar.gz ./bugreport.tar.gz
   

4. Extract and Analyze:

   tar -xzf bugreport.tar.gz
   grep -r "PRIVATE KEY" ./
   grep -r "api_key" ./
   

5. Use Exposed Credentials:

   • TLS Keys: Use the private key to decrypt captured TLS traffic or to set up a man-in-the-middle proxy.
   • Kafka API Keys: Use the API key to connect to the Kafka cluster and consume/produce messages.

Blue Team (Detection & Response)

Detection:

• Monitor for execution of cilium-bugtool with the --envoy-dump flag. This is an unusual command that should trigger an alert.
• Monitor for large tarball files being created in /tmp/ on Cilium pods.
• Monitor for network connections from Cilium pods to external IPs that could indicate exfiltration of the bug report archive.

Response:

1. Isolate the Pod: Immediately cordon the node and evict the Cilium pod to prevent further data collection.
2. Revoke Exposed Credentials:
   • Rotate all TLS certificates and private keys that were in use by Cilium.
   • Rotate all Kafka API keys that were configured in Cilium network policies.
3. Forensic Analysis: Analyze the bug report archive to determine what data was exposed. Check logs for any unauthorized access to Kafka or decrypted TLS traffic.
4. Patch: Upgrade Cilium to a patched version (1.13.17, 1.14.12, or 1.15.6).

Indicators of Compromise (IOCs)

File-Based IOCs:

• File names: cilium-bugtool-*.tar.gz in /tmp/ or other accessible directories.
• File contents containing strings like:
  • -----BEGIN PRIVATE KEY-----
  • -----BEGIN CERTIFICATE-----
  • "api_key": "
  • "tls_certificates":

Process-Based IOCs:

• Process name: cilium-bugtool
• Command line arguments containing --envoy-dump

Network-Based IOCs:

• Unusual outbound connections from Cilium pods to external IPs (potential exfiltration).
• Connections to Kafka clusters using API keys that were not previously seen.

Detection Engineering

YARA Rule

rule CVE_2024_37307_Cilium_Bugtool_Sensitive_Data
{
    meta:
        description = "Detects sensitive data exposure in Cilium bugtool archives"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-37307"
        severity = "high"

    strings:
        $private_key = "-----BEGIN PRIVATE KEY-----"
        $certificate = "-----BEGIN CERTIFICATE-----"
        $api_key = "\"api_key\": \""
        $tls_cert = "\"tls_certificates\":"

    condition:
        any of ($private_key, $certificate, $api_key, $tls_cert)
}

Sigma Rule

title: Cilium Bugtool Envoy Dump Execution
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects execution of cilium-bugtool with the --envoy-dump flag, which may expose sensitive data.
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37307
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/cilium-bugtool'
        CommandLine|contains: '--envoy-dump'
    condition: selection
falsepositives:
    - Legitimate debugging by authorized personnel
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37307 Cilium Bugtool Data Exfiltration"; flow:to_server,established; content:"cilium-bugtool"; nocase; content:".tar.gz"; nocase; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Remediation:

1. Upgrade Cilium: Upgrade to Cilium v1.15.6, v1.14.12, or v1.13.17 immediately.

   helm upgrade cilium cilium/cilium --version 1.15.6
   

2. Rotate Secrets: After upgrading, rotate all TLS certificates, private keys, and Kafka API keys that were in use by Cilium.

Mitigation (if patching is not immediately possible):

• Do not use the --envoy-dump flag when running cilium-bugtool. This is the only trigger for the vulnerability.
• Restrict access to cilium-bugtool using Kubernetes RBAC. Only allow trusted administrators to execute commands inside Cilium pods.
• Monitor and audit all executions of cilium-bugtool with the --envoy-dump flag.

Long-Term Prevention:

• Implement a secrets management solution (e.g., HashiCorp Vault, Kubernetes Secrets) to avoid storing sensitive data in Envoy's configuration.
• Regularly audit Cilium configurations for exposed secrets.
• Use network policies to restrict egress from Cilium pods to prevent exfiltration of bug report archives.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2024-37307