Unauthenticated Access to Metrics in TrustyAI Service Operator

Executive Summary

This vulnerability exists in the gorch service template of the TrustyAI Service Operator. Even when authentication is enabled, the gorch service exposes the orchestrator and detector metrics ports (8032 and 8080) directly without proxying through the kube-rbac-proxy. This means that any pod within the cluster network can access these ports directly, bypassing the intended authentication mechanisms.

The root cause is that the gorch service template publishes these ports openly, and unlike other systems, it does not switch to proxied-only ports when authentication is enabled. Additionally, there is no NetworkPolicy in place to restrict access, resulting in unauthorized access to sensitive metrics.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to the orchestrator and detector metrics ports within a Kubernetes cluster. Any pod on the cluster network can bypass authentication and access sensitive metrics data directly.

Such unauthorized access could expose sensitive operational information, potentially aiding attackers in understanding the system's internal state or exploiting further weaknesses. It represents a security risk by circumventing established access controls.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the gorch service exposes ports 8032 (orchestrator) and 8080 (detector metrics) directly without authentication, allowing access from any pod in the cluster network.

You can use network scanning or port checking commands within your Kubernetes cluster to verify if these ports are accessible without authentication.

• Use kubectl to port-forward and test access: kubectl port-forward svc/gorch 8032:8032 and kubectl port-forward svc/gorch 8080:8080, then attempt to access these ports locally.
• From a pod inside the cluster, use curl or wget to test access: curl http://gorch-service:8032/metrics and curl http://gorch-service:8080/metrics to see if metrics are accessible without authentication.
• Use network scanning tools like nmap from within the cluster to scan the gorch service IP for open ports 8032 and 8080.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the exposed ports 8032 and 8080 by implementing NetworkPolicies to limit which pods can communicate with the gorch service on these ports.

Since the gorch service bypasses kube-rbac-proxy authentication on these ports, enforcing network-level restrictions is critical.

• Create Kubernetes NetworkPolicies that deny all traffic to ports 8032 and 8080 except from trusted pods.
• Review and update the gorch service configuration to avoid exposing these ports directly if possible.
• Monitor and audit access logs to detect any unauthorized access attempts to these ports.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized access to sensitive orchestrator and detector metrics ports within a cluster, bypassing authentication mechanisms. Such unauthorized access could lead to exposure of sensitive operational data or system metrics.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, unauthorized access to internal service metrics could potentially violate security requirements mandated by these regulations, which require strict access controls and protection of sensitive data.

Therefore, this vulnerability may negatively impact compliance with common security standards and regulations by failing to enforce proper authentication and network-level access controls.

Useful 0 Not Useful 0