Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/radius-project/radius | go | < 0.58.0 | 0.58.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the Radius Kubernetes controller and allows for a cross-tenant resource deletion, following the 'Confused Deputy' pattern. The root cause is improper input validation of user-controllable annotations on Kubernetes Deployment objects.
The analysis of the security advisory and the associated patch (PR #11967) reveals the attack path. An attacker can modify the radapp.io/status annotation on a Deployment they control. The reconciler.readAnnotations function in pkg/controller/reconciler/annotations.go would then read this annotation and deserialize the JSON content without validating it. The attacker can set the container field in the JSON to the full resource ID of a container in a different tenant.
Subsequently, during the reconciliation process, specifically in the deletion phase handled by reconciler.DeploymentReconciler.startDeleteOperationIfNeeded in pkg/controller/reconciler/deployment_reconciler.go, the controller uses this untrusted container ID to perform a deletion. Because the controller operates with high privileges, it can delete resources across different tenants without proper authorization checks, leading to a denial of service for the victim tenant.
The patch addresses this by introducing two main fixes:
annotations.go, it adds validation (validateDeploymentStatus) to ensure the data within the radapp.io/status annotation is consistent and well-formed.deployment_reconciler.go, it adds an ownership check within startDeleteOperationIfNeeded. Before deleting a container, the controller now fetches the container's metadata and verifies that it has a resource reference back to the specific deployment being reconciled. If the ownership does not match, the deletion is aborted, preventing the cross-tenant attack.reconciler.readAnnotationspkg/controller/reconciler/annotations.go
reconciler.DeploymentReconciler.startDeleteOperationIfNeededpkg/controller/reconciler/deployment_reconciler.go
reconciler.deleteContainerpkg/controller/reconciler/util.go
reconciler.DeploymentReconciler.reconcileDeletepkg/controller/reconciler/deployment_reconciler.go