GHSA-wmj8-9953-vff5: OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within Kubernetes clusters. Affected Versions - OpenCost: All versions up to and including the latest release - Vulnerable File: pkg/costmodel/router.go (lines 365-379) - Vulnerable Endpoint: POST /serviceKey Vulnerability Details Root Cause The AddServiceKey function in pkg/costmodel/router.go accepts user-supplied data via POST request and writes it directly to a file without any authentication or input validation: func (a *Accesses) AddServiceKey(w http.ResponseWriter, r *http.Request, ps httprouter.Params) { w.Header().Set("Content-Type", "application/json") w.Header().Set("Access-Control-Allow-Origin", "*") // Overly permissive CORS r.ParseForm() key := r.PostForm.Get("key") // User-controlled input, no validation k := []byte(key) err := os.WriteFile(env.GetGCPAuthSecretFilePath(), k, 0644) // Direct file write if err != nil { fmt.Fprintf(w, "Error writing service key: %s", err) } w.WriteHeader(http.StatusOK) } File Path Determination (core/pkg/env/core.go): func GetGCPAuthSecretFilePath() string { return GetPathFromConfig("key.json") } func GetPathFromConfig(fileName string) string { return filepath.Join(GetConfigPath(), fileName) } func GetConfigPath() string { return Get(ConfigPathEnvVar, DefaultConfigPath) // Default: /var/configs } Security Issues 1. No Authentication: Any network-accessible client can invoke the endpoint 2. No Input Validation: User input is not validated as a valid GCP service account key 3. Overly Permissive CORS: Access-Control-Allow-Origin: * allows cross-origin attacks 4. Predictable File Path: File location controlled by CONFIG_PATH environment variable Proof of Concept Environment Setup Prerequisites - Kubernetes cluster (tested on