--- title: The Kubernetes Crossplane CVE- 2023-27483 description: Learn how to protect yourself from CVE-2023-27483, a high-rated vulnerability affecting users of crossplane-runtime libraries in a Kubernetes cluster. --- ![bg blog-1](https://blog.rad.security/hs-fs/hubfs/bg%20blog-1.jpg?width=300&name=bg%20blog-1.jpg) [Jimmy Mesta](https://blog.rad.security/blog/author/jimmy-mesta)Mar 17, 2023 9:00:00 AM2 min read # The Kubernetes Crossplane CVE- 2023-27483 [Previous ](https://blog.rad.security/blog/how-ksoc-protects-against-the-dero-cryptocurrency-miner) [Next ](https://blog.rad.security/blog/the-top-tips-to-avoid-excessive-kubernetes-rbac-permissions) ## Introduction CVE-2023-27483 has just been released, affecting users of crossplane-runtime libraries in a Kubernetes cluster. In this blog you will learn how to find out if you are affected, possible mitigations, and how KSOC can help. In general, you can protect yourself against exploitation of this CVE with the patched versions of crossplane-runtime that are available. We recommend considering a version upgrade before implementing other mitigation techniques. [On-Demand KSOC Demo](https://go.rad.security/monthly-demo-3-15) ## What is it Crossplane is a set of Golang libraries which allows developers to build a Kubernetes control plane that crosses multiple cloud service providers.  [CVE-2023-27483](https://nvd.nist.gov/vuln/detail/CVE-2023-27483?ref=blog.ksoc.com) is a High rated vulnerability scoring a 7.5 on the CVSS scale. Affected versions of Crossplane which use the ‘Paved’ type’s ‘SetValue’ method with user provided input have the potential to consume excessive amounts of memory unless there has been an added input validation check. A remote authenticated attacker can craft a special request using that method in order to cause a denial of service. Ada Logics, sponsored by the CNCF, were able to perform fuzz testing to prove the exploit as mentioned [here](https://github.com/advisories/GHSA-vfvj-3m3g-m532?ref=blog.ksoc.com). ## Mitigation To fix the issue, the remediated package versions have added the required input validation into the Crossplane package. For customers using vulnerable crossplane packages who cannot upgrade, we suggest to build input validation on the path before passing it to ‘SetValue’. As the paths’ index is capped at max uint32, KSOC recommends that the input validation would at a minimum constrain the index size to be below 4294967295. ## Detecting Exploitation attempts Some WAF tools may have the ability to highlight HTTP requests which contain the DoS payload. In order to exploit the vulnerability, an attacker would need to be authenticated to the control plane and send a payload which contains: ‘Paved’ type to the ‘FieldPath’ package where the message exceeds the size of uint32. Customers who cannot upgrade Crossplane should consider working with their WAF vendor to create a custom rule that works for their environment. ## How can I tell if I am affected? The affected versions of Crossplane are <0.16.1, >= 0.17.0, and <0.19.2. This has been patched in 0.19.2 and 0.16.1. Image scanning tools which output a SBOM should list the crossplane package version running in the control plane images. Not all vulnerability databases are updated at the same frequency, so referencing the SBOM package version of crossplane will quickly identify if there is an affected version running in your cluster. ## How can KSOC help? KSOC can help detect and find vulnerable versions of Crossplane deployed across your clusters. While most image or IaC scanning capabilities will only be able to detect the presence of the vulnerable packages, KSOC can detect whether the vulnerable packages are actually deployed, whether via image scanning or creation of a SBOM. That is the advantage of our real-time, event-driven Kubernetes Security and Posture Management (KSPM) platform. See what real-time looks like in the Kubernetes platform with this [on-demand 20 minute demo](https://go.ksoc.com/monthly-demo-3-15?ref=blog.ksoc.com). [On-Demand Demo](https://go.rad.security/monthly-demo-3-15) ![avatar](https://21384273.fs1.hubspotusercontent-na1.net/hubfs/21384273/Jimmy%20Mesta%20Headshot-2.png) #### [Jimmy Mesta](https://blog.rad.security/blog/author/jimmy-mesta) Jimmy Mesta is the founder and Chief Technology Officer at RAD Security. He is responsible for the technological vision for the RAD Security platform. A veteran security engineering leader focused on building cloud-native security solutions, Jimmy has held various leadership positions with enterprises navigating the growth of cloud services and containerization. Previously, Jimmy was an independent consultant focused on building large-scale cloud security programs, delivering technical security training, producing research and securing some of the largest containerized environments in the world. ## RELATED ARTICLES ```json { "@context" : "https://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "", "addressLocality" : "San Francisco", "addressRegion" : "CA", "postalCode" : "94114", "streetAddress" : "584 Castro St" }, "knowsLanguage" : "en", "logo" : { "@type" : "ImageObject", "url" : "https://21384273.fs1.hubspotusercontent-na1.net/hubfs/21384273/RAD%20White%203.0.png" }, "name" : "RAD Security", "url" : "https://blog.rad.security/blog/the-kubernetes-crossplane-cve-2023" } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "abstract" : "Learn how to protect yourself from CVE-2023-27483, a high-rated vulnerability affecting users of crossplane-runtime libraries in a Kubernetes cluster.", "author" : { "@type" : "Person", "name" : "Jimmy Mesta" }, "dateModified" : "February 5, 2024 7 PM", "datePublished" : "March 17, 2023 1 PM", "headline" : "The Kubernetes Crossplane CVE- 2023-27483", "image" : "", "inLanguage" : "en", "keywords" : "[Kubernetes, Vulnerability Management]", "mainEntityOfPage" : { "@type" : "WebPage" }, "name" : "The Kubernetes Crossplane CVE- 2023-27483", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://21384273.fs1.hubspotusercontent-na1.net/hubfs/21384273/RAD-Full-Logo-Mono-Black-PNG.png" }, "name" : "RAD Security" }, "text" : "Introduction CVE-2023-27483 has just been released, affecting users of crossplane-runtime libraries in a Kubernetes cluster. In this blog you will learn how to find out if you are affected, possible mitigations, and how KSOC can help. In general, you can protect yourself against exploitation of this CVE with the patched versions of crossplane-runtime that are available. We recommend considering a version upgrade before implementing other mitigation techniques. On-Demand KSOC Demo What is it Crossplane is a set of Golang libraries which allows developers to build a Kubernetes control plane that crosses multiple cloud service providers. CVE-2023-27483 is a High rated vulnerability scoring a 7.5 on the CVSS scale. Affected versions of Crossplane which use the ‘Paved’ type’s ‘SetValue’ method with user provided input have the potential to consume excessive amounts of memory unless there has been an added input validation check. A remote authenticated attacker can craft a special request using that method in order to cause a denial of service. Ada Logics, sponsored by the CNCF, were able to perform fuzz testing to prove the exploit as mentioned here. Mitigation To fix the issue, the remediated package versions have added the required input validation into the Crossplane package. For customers using vulnerable crossplane packages who cannot upgrade, we suggest to build input validation on the path before passing it to ‘SetValue’. As the paths’ index is capped at max uint32, KSOC recommends that the input validation would at a minimum constrain the index size to be below 4294967295. Detecting Exploitation attempts Some WAF tools may have the ability to highlight HTTP requests which contain the DoS payload. In order to exploit the vulnerability, an attacker would need to be authenticated to the control plane and send a payload which contains: ‘Paved’ type to the ‘FieldPath’ package where the message exceeds the size of uint32. Customers who cannot upgrade Crossplane should consider working with their WAF vendor to create a custom rule that works for their environment. How can I tell if I am affected? The affected versions of Crossplane are <0.16.1, >= 0.17.0, and <0.19.2. This has been patched in 0.19.2 and 0.16.1. Image scanning tools which output a SBOM should list the crossplane package version running in the control plane images. Not all vulnerability databases are updated at the same frequency, so referencing the SBOM package version of crossplane will quickly identify if there is an affected version running in your cluster. How can KSOC help? KSOC can help detect and find vulnerable versions of Crossplane deployed across your clusters. While most image or IaC scanning capabilities will only be able to detect the presence of the vulnerable packages, KSOC can detect whether the vulnerable packages are actually deployed, whether via image scanning or creation of a SBOM. That is the advantage of our real-time, event-driven Kubernetes Security and Posture Management (KSPM) platform. See what real-time looks like in the Kubernetes platform with this on-demand 20 minute demo. On-Demand Demo", "url" : "https://blog.rad.security/blog/the-kubernetes-crossplane-cve-2023", "wordCount" : "1173" } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Jimmy Mesta", "url" : "https://blog.rad.security/blog/author/jimmy-mesta" }, "dateModified" : "2024-02-05T19:22:39.282Z", "datePublished" : "2023-03-17T13:00:00.000Z", "headline" : "The Kubernetes Crossplane CVE- 2023-27483", "mainEntityOfPage" : { "@id" : "https://blog.rad.security/blog/the-kubernetes-crossplane-cve-2023", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.rad.security/hubfs/RAD%20White%203.0.png" }, "name" : "Rad Security" } } ```