koku-metrics-operator OAuth Token Endpoint Exposure

Executive Summary

This vulnerability affects the koku-metrics-operator's CostManagementMetricsConfig custom resource. It allows a user with edit permissions to set an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, potentially exposing these credentials to an attacker.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized modifications to the CostManagementMetricsConfig CRD in your koku-metrics-operator deployment. Inspect logs for unexpected HTTP POST requests to external endpoints from the operator. Verify that the token_url field in any CostManagementMetricsConfig resources does not point to untrusted domains.

Useful 0 Not Useful 0

Impact Analysis

An attacker could obtain the client_id and client_secret, gaining access to the api.console scope on console.redhat.com for your organization. This could lead to unauthorized access to sensitive data or services associated with your Red Hat account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive credentials, potentially exposing personal or health data. If credentials are compromised, attackers may gain access to systems handling regulated data, violating GDPR or HIPAA requirements for data protection and access control.

Useful 0 Not Useful 0

Mitigation Strategies

Update the koku-metrics-operator to a patched version where the token_url is hard-coded to the Red Hat SSO endpoint or enforce a suffix allow-list (e.g., *.redhat.com) in the GetAccessToken function. Remove any existing CostManagementMetricsConfig resources with modified token_url fields and revoke any exposed client_id and client_secret credentials.

Useful 0 Not Useful 0