CVE-2024-5651

What it actually does

The flaw permits remote code execution by injecting arbitrary commands via --ssh-path or --telnet-path arguments in a FenceAgentsRemediation custom resource, executed on the operator pod and escalating from the operator service account to a cluster-admin service account.

Why it matters to the business

Successful exploitation grants full cluster control, enabling data theft, service disruption, or persistent access; low EPSS and no KEV status indicate limited observed exploitation risk despite the high severity, with no ransomware association.

How an attack unfolds

A low-privilege user such as one with developer rights creates a malicious FenceAgentsRemediation resource targeting a fence agent that supports the ssh or telnet path arguments, causing the operator to execute the attacker-supplied command on its pod and then leverage service-account privileges to reach cluster-admin rights.

How to fix it

Upgrade affected packages to the listed fixed versions: libapache-mod-jk (Debian:11) to 1:1.2.26-2.1, libapache-mod-jk (Debian:12) to 1:1.2.26-2.1, and libapache-mod-jk (Debian:13) to 1:1.2.26-2.1; apply the updates promptly given the published date of 2024-08-12 and stable low EPSS trend.

How to confirm the fix worked

Verify the installed package versions match or exceed the fixed releases listed for each Debian release; review cluster role bindings and service-account permissions to confirm the operator no longer runs with excessive privileges.

Typical attack path

1. Obtain developer-level access to the cluster
2. Craft a FenceAgentsRemediation custom resource containing malicious commands in the --ssh-path or --telnet-path fields
3. Apply the resource to trigger command execution inside the operator pod
4. Escalate from the operator service account to a cluster-admin service account

How to detect it

Search audit logs and Kubernetes API server logs for creation or updates of FenceAgentsRemediation resources containing suspicious values in ssh-path or telnet-path fields; inspect operator pod process trees and executed commands for unexpected binaries or arguments.

What your security team should do

• Prioritize patching the listed Debian packages within standard change windows due to the 791 days since publication and unchanged EPSS
• Audit all FenceAgentsRemediation custom resources for unexpected path arguments
• Restrict developer permissions on resources that can influence the operator pod
• Monitor for new custom-resource creations that reference ssh or telnet path fields