OpenShift builds don't seem to cache the SSH key of the git repository. This allows an attacker who can MiTM, take over DNS etc to supply their own content.
Created repro; confirmed against 3.9, 3.11 and 4.1 rc5.
Tracked to scmauth/sshkey.go within builder. Link here is for 3.11 https://github.com/openshift/origin/blob/release-3.11/pkg/build/builder/cmd/scmauth/sshkey.go#L26-L28 content := "#!/bin/sh\nssh -i " + filepath.Join(baseDir, SSHPrivateKeyMethodName) + " -o StrictHostKeyChecking=false \"$@\"\n"
Flagging 3.6 and later as all affected from observation of source code.
Acknowledgments: Name: @l14n_uk
Statement: OpenShift Container Platform allows for various types of "source clone secrets" to be defined in order to permit building from non-public git repositories. When using ssh key authentication, the server host key checking function is disabled. An attacker with the ability to redirect the network traffic and perform a "man in the middle" attack will be able to redirect the build job to use arbitrary content of their choosing. Note that the same flaw (non-verification of remote server) is present when using HTTP, or when using HTTPS with TLS verification manually disabled.
External References: https://docs.openshift.com/container-platform/3.11/dev_guide/builds/build_inputs.html#source-secrets-ssh-key-authentication
Mitigation: Use only methods (such as HTTPS with TLS verification) that enable the identity of the remote repository to be validated.
Updating CVSS to align to other MITM style flaws. - MITM can be performed through many means (DNS redirection, traffic redirection, etc), leading to a complex attack. - Attacking user needs no local privs on the cluster, and with MITM abilities can observe traffic requests in order to construct their attack. - Scope is unchanged - whatever permissions in the cluster the builder pod has, they remain the same with the altered build content.
Created origin tracking bugs for this issue: Affects: fedora-all [bug 1715256]
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.10 Via RHSA-2019:2989 https://access.redhat.com/errata/RHSA-2019:2989
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-10150
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.1 Via RHSA-2019:3007 https://access.redhat.com/errata/RHSA-2019:3007
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.11 Via RHSA-2019:3143 https://access.redhat.com/errata/RHSA-2019:3143
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.9 Via RHSA-2019:3811 https://access.redhat.com/errata/RHSA-2019:3811