A vulnerability in Fission's buildermgr controller allowed cross-namespace environment references in Package CRDs without verifying that the environment namespace matched the package's namespace. An attacker with create permissions on packages in their own namespace could specify an environment in another tenant's namespace, causing the controller to execute build commands in the victim namespace's builder pod. By embedding malicious code in build lifecycle hooks, the attacker could read the victim namespace's fission-builder service account token from the builder pod and exfiltrate it through the build log. This token could then be used to read all Secrets and ConfigMaps in the victim namespace, resulting in cross-tenant compromise. The vulnerability was addressed in pull request #3379 and released in version 1.24.0, which added admission webhook validation and controller-side checks to reject packages with mismatched environment namespaces.

This vulnerability enables an attacker with package creation privileges in their own namespace to execute arbitrary code in another tenant's builder pod and exfiltrate that tenant's fission-builder service account token. The attacker can then use this token to read all Secrets and ConfigMaps in the victim namespace, leading to a complete compromise of sensitive configuration data within that namespace. This represents a high-severity cross-tenant privilege escalation and data exfiltration risk.

A fix is available in Fission version 1.24.0. The update enforces that the Package.spec.environment.namespace must match the Package.metadata.namespace via an admission webhook and controller-level checks, preventing cross-namespace environment references. Users should upgrade to version 1.24.0 or later to remediate this vulnerability. No additional mitigations are required if the fix is applied.