CVE-2025-24784

Executive Summary

CVE-2025-24784 is a privilege escalation vulnerability in the Kubewarden Kubernetes admission controller, specifically affecting the AdmissionPolicyGroup Custom Resource Definition (CRD) introduced in version 1.17.0. The vulnerability allows non-admin users to deploy "context-aware" policies that can query the Kubernetes API with the elevated privileges of the Policy Server's ServiceAccount. This can lead to unauthorized information disclosure of cluster resources that the attacker would not normally have access to.

The vulnerability has a CVSS score of 4.3 (Medium) and is fixed in Kubewarden controller version 1.21.0. The impact is limited by the principle of least privilege applied to the Policy Server's ServiceAccount, but default Helm chart grants access to Namespace, Pod, Deployment, and Ingress resources cluster-wide.

Supply Chain & Package Security

This vulnerability affects the Kubewarden controller, which is distributed as a Go-based Kubernetes operator. The fix is available in version 1.21.0. Users should update their Helm charts or operator deployments to the latest version. No malicious packages have been identified in the supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) - The vulnerability can be exploited over the network via Kubernetes API calls.
• Attack Complexity: Low (AC:L) - No special conditions are required for exploitation.
• Privileges Required: Low (PR:L) - The attacker needs access to create or manage AdmissionPolicyGroup resources in a namespace they own.
• User Interaction: None (UI:N) - No user interaction is required.
• Scope: Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality: Low (C:L) - Limited information disclosure of cluster resources.
• Integrity: None (I:N) - No data modification possible.
• Availability: None (A:N) - No denial of service impact.

Deep Dive & Mechanics

The Kubewarden controller allows dynamic registration of admission policies. The AdmissionPolicyGroup CRD, introduced in version 1.17.0, is namespaced and intended to be safe for non-admin users to manage within their own namespaces. However, the CRD did not restrict the deployment of "context-aware" policies—policies that can query the Kubernetes API at evaluation time.

Context-aware policies use the ServiceAccount of the Policy Server instance to perform list and get operations against the cluster. This ServiceAccount typically has broader permissions than a regular user. By deploying a context-aware policy via AdmissionPolicyGroup, an attacker can leverage the Policy Server's elevated RBAC privileges to enumerate resources outside their namespace.

The vulnerability is rooted in the lack of validation or restriction on the contextAwareResources field within the AdmissionPolicyGroup spec. The fix in version 1.21.0 ensures that context-aware policies can only be deployed by admin users (e.g., via ClusterAdmissionPolicy), not through namespaced AdmissionPolicyGroup.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.21.0): The AdmissionPolicyGroup CRD allowed any user with permissions to create the resource to set the contextAwareResources field, enabling context-aware policies.

apiVersion: policies.kubewarden.io/v1
kind: AdmissionPolicyGroup
metadata:
  name: example-policy
  namespace: attacker-namespace
spec:
  policies:
    - module: registry://ghcr.io/kubewarden/policies/context-aware-policy:v1
      contextAwareResources:
        - apiVersion: v1
          kind: Secret

Patched Code (1.21.0+): The controller now rejects AdmissionPolicyGroup resources that specify contextAwareResources. Only ClusterAdmissionPolicy resources can use context-aware policies.

apiVersion: policies.kubewarden.io/v1
kind: AdmissionPolicyGroup
metadata:
  name: example-policy
  namespace: attacker-namespace
spec:
  policies:
    - module: registry://ghcr.io/kubewarden/policies/context-aware-policy:v1
      # contextAwareResources field is ignored or rejected

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Kubernetes cluster with Kubewarden controller < 1.21.0 installed.
• Ability to create AdmissionPolicyGroup resources in a namespace you own.
• Policy Server's ServiceAccount has permissions to list/get resources (default: Namespace, Pod, Deployment, Ingress).

Exploitation Steps:

1. Identify a context-aware policy module that can query Kubernetes API (e.g., a policy that lists pods).
2. Create an AdmissionPolicyGroup that references this policy and sets contextAwareResources to target sensitive resources (e.g., Secrets, ConfigMaps).
3. Trigger the policy evaluation by creating a resource that matches the policy's rules.
4. Exfiltrate the data via policy logs or side effects (e.g., the policy might log the results).

Example Exploit YAML:

apiVersion: policies.kubewarden.io/v1
kind: AdmissionPolicyGroup
metadata:
  name: exploit-policy
  namespace: attacker-namespace
spec:
  policies:
    - module: registry://ghcr.io/kubewarden/policies/context-aware-policy:v1
      contextAwareResources:
        - apiVersion: v1
          kind: Secret
      settings:
        # Policy-specific settings to return data

Blue Team

Detection:

• Monitor for AdmissionPolicyGroup resources that include contextAwareResources field.
• Alert on creation of policies referencing unknown or suspicious modules.
• Audit Policy Server logs for unexpected API calls.

Mitigation:

• Update Kubewarden controller to version 1.21.0 or later.
• Restrict creation of AdmissionPolicyGroup resources to trusted users only.
• Apply least privilege to Policy Server's ServiceAccount.

Indicators of Compromise (IOCs)

• Kubernetes Audit Logs: Creation of AdmissionPolicyGroup with contextAwareResources field.
• Policy Server Logs: Unusual API calls to list/get Secrets, ConfigMaps, or other sensitive resources.
• Network Traffic: Outbound connections from Policy Server pods to unexpected endpoints (if policy exfiltrates data).

Detection Engineering

YARA Rule

rule Detect_Kubewarden_AdmissionPolicyGroup_Exploit {
    meta:
        description = "Detects AdmissionPolicyGroup resources with contextAwareResources field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24784"
    strings:
        $context_aware = "contextAwareResources"
        $policy_group = "AdmissionPolicyGroup"
    condition:
        $policy_group and $context_aware
}

Sigma Rule

title: Kubewarden AdmissionPolicyGroup Context-Aware Policy Creation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of AdmissionPolicyGroup resources with contextAwareResources field, indicating potential exploitation of CVE-2025-24784
author: Valters IT
date: 2025-04-10
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        verb: create
        objectRef.resource: admissionpolicygroups
        requestObject.spec.policies.contextAwareResources: exists
    condition: selection
falsepositives:
    - Legitimate use by administrators before patching
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Kubewarden Policy Server Potential Data Exfiltration"; flow:to_server; content:"|7b 22 6b 69 6e 64 22 3a 22 53 65 63 72 65 74 22|"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Kubewarden controller to version 1.21.0 or later.
2. Workaround: Restrict creation of AdmissionPolicyGroup resources to cluster administrators only using RBAC.
3. Long-term: Apply least privilege to the Policy Server's ServiceAccount. Regularly audit RBAC permissions.
4. Monitoring: Enable Kubernetes audit logging and monitor for suspicious AdmissionPolicyGroup creations.

Valters IT
Securing Kubernetes, One Policy at a Time