Aws Efs Csi Driver
Monthly
Unverified access-point ownership in the AWS EFS CSI Driver before v3.4.1 enables an authenticated Kubernetes user holding PersistentVolume creation privileges to trigger recursive deletion of directory trees on EFS filesystems they are not authorized to access. The volume deletion component accepts a crafted volumeHandle that cross-pairs an access point from one EFS filesystem with a different target filesystem, and the driver never validates that the access point belongs to the stated filesystem before executing the deletion. No public exploit has been identified at time of analysis, but the technique is mechanically straightforward for any attacker who already holds the required cluster-scoped RBAC rights.
Improper neutralization of argument delimiters in AWS EFS CSI Driver before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection, potentially leading to privilege escalation or unauthorized data access within Kubernetes clusters using EFS storage. The vulnerability requires high privileges (PersistentVolume admin role) but can be exploited remotely over the network with low complexity. Vendor-released patch v3.0.1 is available.
Unverified access-point ownership in the AWS EFS CSI Driver before v3.4.1 enables an authenticated Kubernetes user holding PersistentVolume creation privileges to trigger recursive deletion of directory trees on EFS filesystems they are not authorized to access. The volume deletion component accepts a crafted volumeHandle that cross-pairs an access point from one EFS filesystem with a different target filesystem, and the driver never validates that the access point belongs to the stated filesystem before executing the deletion. No public exploit has been identified at time of analysis, but the technique is mechanically straightforward for any attacker who already holds the required cluster-scoped RBAC rights.
Improper neutralization of argument delimiters in AWS EFS CSI Driver before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection, potentially leading to privilege escalation or unauthorized data access within Kubernetes clusters using EFS storage. The vulnerability requires high privileges (PersistentVolume admin role) but can be exploited remotely over the network with low complexity. Vendor-released patch v3.0.1 is available.