Executive Summary

This vulnerability in Fission, a Kubernetes-native serverless framework, arises from insufficient validation of the RelativeURL and Prefix fields in HTTPTrigger resources prior to version 1.25.0.

Originally, these fields were only validated at the CLI level, and after modernization replaced the admission webhook with API-server CEL validation, no validation rules existed for these fields at the API server level.

As a result, an attacker with permission to create HTTPTriggers could bypass URL-level checks by creating triggers via kubectl or direct Kubernetes API calls with empty, malformed, or reserved paths, such as empty paths, directory traversal sequences, root-only paths, or paths colliding with internal routes.

This could lead to routing disruptions or unauthorized access.

The issue was fixed in version 1.25.0 by adding strict validation rules both at the API server admission layer and in the application code to enforce path safety and prevent such bypasses.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker with HTTPTrigger creation permissions to create triggers with malformed or unauthorized URL paths.

Such malformed paths can disrupt normal routing behavior within the Fission framework, potentially causing denial of service or interference with legitimate function routing.

Additionally, paths that collide with reserved or internal routes could be exploited to gain unauthorized access or manipulate internal functions, compromising the integrity of the system.

The CVSS score of 4.3 indicates a medium severity impact primarily related to integrity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting HTTPTrigger resources in your Kubernetes cluster for malformed or suspicious RelativeURL or Prefix fields that bypass validation rules.

Specifically, look for HTTPTriggers created via kubectl or direct Kubernetes REST API calls that have:

• Empty RelativeURL and no Prefix specified.
• Paths containing directory traversal sequences (e.g., /api/../admin).
• Root-only paths (e.g., /).
• Paths colliding with router-owned or reserved routes (e.g., /router-healthz, /readyz, /_version, /auth/login).
• Paths colliding with internal function prefixes (e.g., /fission-function/<namespace>/<name>).

You can use kubectl commands to list and inspect HTTPTrigger resources, for example:

• kubectl get httptriggers --all-namespaces -o json | jq '.items[] | {name: .metadata.name, namespace: .metadata.namespace, relativeURL: .spec.relativeURL, prefix: .spec.prefix}'
• kubectl get httptrigger <trigger-name> -n <namespace> -o yaml

Review the output for any RelativeURL or Prefix fields that match the suspicious patterns described above.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade your Fission installation to version 1.25.0 or later, where this vulnerability has been patched.

The fix includes adding strict validation rules at the API server admission layer (using CEL) and in the application layer to ensure that HTTPTrigger paths are properly validated.

Until you can upgrade, consider the following immediate actions:

• Audit existing HTTPTrigger resources for invalid or suspicious RelativeURL and Prefix fields and remove or correct them.
• Restrict permissions to create or modify HTTPTrigger resources to trusted users only.
• Monitor Kubernetes API server logs and audit logs for suspicious HTTPTrigger creation or modification attempts.

These steps help prevent exploitation by ensuring only valid HTTPTriggers are deployed and unauthorized path manipulations are detected.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users with HTTPTrigger creation permissions to bypass URL-level validation checks, potentially creating malformed or malicious HTTPTriggers that could disrupt routing or gain unauthorized access.

While the CVE description and resources do not explicitly mention compliance with standards such as GDPR or HIPAA, the potential for unauthorized access or routing disruption could impact data integrity and security controls required by these regulations.

Therefore, organizations using affected versions of Fission might face increased risk of non-compliance if this vulnerability is exploited, as it could undermine the integrity and security of applications handling sensitive data.

Useful 0 Not Useful 0