CVE-2024-45496
CRITICALOpenShift Controller Manager - Privilege Escalation via Crafted .gitconfig File
Title source: llmExploitation Summary
EIP tracks 6 public exploits for CVE-2024-45496. PoCs published by pairofglasses, eggpratacurry, biggerbangg.
AI-analyzed exploit summary The repository contains no functional exploit code, only a Dockerfile and a README redirecting to an external site. The lack of technical details and reliance on an external link for information are strong indicators of a suspicious repository.
Description
A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process. During the build initialization step, the git-clone container is run with a privileged security context, allowing unrestricted access to the node. An attacker with developer-level access can provide a crafted .gitconfig file containing commands executed during the cloning process, leading to arbitrary command execution on the worker node. An attacker running code in a privileged container could escalate their permissions on the node running the container.
Exploits (6)
The repository contains no functional exploit code, only a Dockerfile and a README redirecting to an external site. The lack of technical details and reliance on an external link for information are strong indicators of a suspicious repository.
The repository contains no functional exploit code, only a Dockerfile and a README redirecting to an external site. This is a common pattern for luring researchers into downloading malware or paying for fake exploits.
The repository contains a minimal Dockerfile and a README redirecting to an external site, with no actual exploit code or technical details about CVE-2024-45496.
The repository contains no functional exploit code, only a Dockerfile with a placeholder and a README redirecting to an external site. This is characteristic of a social engineering lure.
This repository contains a functional exploit for CVE-2024-45496, leveraging Git smudge filters to execute arbitrary commands on a host system during a Docker build process. The exploit deploys a persistent C2 agent by hijacking the `kubenswrapper` binary and uses a `helloworld:` prefix in build input files to execute commands.
This repository contains a functional exploit for CVE-2024-45496, leveraging a malicious Git filter to achieve remote code execution (RCE) on OpenShift nodes. The exploit deploys a persistent C2 agent by hijacking the build process and mounting the host filesystem.
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L