External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`.
Version 1.3.2 contains a patch.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc…
security-advisories@github.com
https://github.com/external-secrets/external-secrets/pull/5901
security-advisories@github.com
https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2
security-advisories@github.com
https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q…
security-advisories@github.com