GHSA-VCHH-R53J-8MPW中危已审查

Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

OSV 1.4.0 · github-reviewed · 修改于 2026-07-29 04:16

发布时间

2026-07-29 04:16

GitHub 审查时间

2026-07-29 04:16

NVD 发布时间

2026-06-11 02:17

源文件

advisories/github-reviewed/2026/07/GHSA-vchh-r53j-8mpw/GHSA-vchh-r53j-8mpw.json

公告说明

HTTPTriggerSpec.Validate() validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only (pkg/fission-cli/cmd/httptrigger/create.go:83). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via kubectl apply or a direct Kubernetes REST API call bypassed every URL-level check.

A tenant with HTTPTrigger create permission could therefore create triggers whose RelativeURL or Prefix:

was empty (with both fields unset, the trigger has no URL),
did not start with /,
was exactly / (claiming the entire router root),
contained .. traversal segments (e.g. /api/../admin),
collided with router-owned routes: /router-healthz, /readyz, /_version, /auth/login,
collided with the router-internal function prefix /fission-function/<ns>/<name>.

Affected

Project: github.com/fission/fission
Versions: all versions through v1.24.0
Audited commit: 647c141
Component: pkg/apis/core/v1/validation.go:HTTPTriggerSpec.Validate (and the missing CEL on HTTPTriggerSpec)
Configuration: default

Fix section (paste into the Fix / Patches field)

Fixed in v1.25.0 by:

PR #3464 (commit ) — enforce the path-safety invariants at both admission layers so the API server's CEL evaluation and the Go-side agree:

Three +kubebuilder:validation:XValidation rules on HTTPTriggerSpec (the API server's CEL admission gate, regenerated into crds/v1/fission.io_httptriggers.yaml):
- at least one of relativeurl or prefix must be non-empty;
- relativeurl, when set, must start with /, must not be /, must contain no .. segment, must not be in the reserved exact-path set, and must not start with /fission-function/;
- prefix, when set, the same rules guarded by has(self.prefix).
validateTriggerPath helper in pkg/apis/core/v1/validation.go, invoked from HTTPTriggerSpec.Validate(), mirrors the CEL rules so the CLI's early rejection and the router reconciler's status-Condition path match what the API server admits.

标识信息

别名 / CVE

CVE-2026-50569

CWE

CWE-20

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

原始 OSV JSON

{
  "id": "GHSA-vchh-r53j-8mpw",
  "aliases": [
    "CVE-2026-50569"
  ],
  "details": "`HTTPTriggerSpec.Validate()` validated `Methods`, `FunctionReference`, `Host`, `IngressConfig`, and `CorsConfig`, but silently skipped `RelativeURL` and `Prefix`. Those two fields were validated at the CLI level only\n(`pkg/fission-cli/cmd/httptrigger/create.go:83`). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via `kubectl apply` or\na direct Kubernetes REST API call bypassed every URL-level check.\n\nA tenant with HTTPTrigger create permission could therefore create triggers whose `RelativeURL` or `Prefix`:\n\n- was empty (with both fields unset, the trigger has no URL),\n- did not start with `/`,\n- was exactly `/` (claiming the entire router root),\n- contained `..` traversal segments (e.g. `/api/../admin`),\n- collided with router-owned routes: `/router-healthz`, `/readyz`, `/_version`, `/auth/login`,\n- collided with the router-internal function prefix `/fission-function/<ns>/<name>`.\n\n### Affected\n\n- Project: `github.com/fission/fission`\n- Versions: all versions through v1.24.0\n- Audited commit: `647c141`\n- Component: `pkg/apis/core/v1/validation.go:HTTPTriggerSpec.Validate` (and the missing CEL on `HTTPTriggerSpec`)\n- Configuration: default\n\nFix section (paste into the Fix / Patches field)\n\nFixed in [v1.25.0](https://github.com/fission/fission/releases/tag/v1.25.0) by:\n\n- [PR #3464](https://github.com/fission/fission/pull/3464) (commit [`0deed6bf`](https://github.com/fission/fission/commit/0deed6bf2af2a0c0c6094b25e1a0afad36773e3b)) — enforce the path-safety invariants at both admission layers so the API\nserver's CEL evaluation and the Go-side `HTTPTriggerSpec.Validate()` agree:\n  - Three `+kubebuilder:validation:XValidation` rules on `HTTPTriggerSpec` (the API server's CEL admission gate, regenerated into `crds/v1/fission.io_httptriggers.yaml`):\n    - at least one of `relativeurl` or `prefix` must be non-empty;\n    - `relativeurl`, when set, must start with `/`, must not be `/`, must contain no `..` segment, must not be in the reserved exact-path set, and must not start with `/fission-function/`;\n    - `prefix`, when set, the same rules guarded by `has(self.prefix)`.\n  - `validateTriggerPath` helper in `pkg/apis/core/v1/validation.go`, invoked from `HTTPTriggerSpec.Validate()`, mirrors the CEL rules so the CLI's early rejection and the router reconciler's status-Condition path match what the API\nserver admits.\n\nRegression coverage: a new `TestHTTPTriggerSpecValidate_Path` table in `pkg/apis/core/v1/validation_validators_test.go` exercises every PoC case from the advisory plus literal `..`-prefixed-segment positives that must remain allowed.",
  "summary": "Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.0"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/fission/fission",
        "ecosystem": "Go"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 1.24.0"
      }
    }
  ],
  "modified": "2026-07-28T20:16:00Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
    }
  ],
  "published": "2026-07-28T20:16:00Z",
  "references": [
    {
      "url": "https://github.com/fission/fission/security/advisories/GHSA-vchh-r53j-8mpw",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50569",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/fission/fission/pull/3464",
      "type": "WEB"
    },
    {
      "url": "https://github.com/fission/fission/commit/0deed6bf3f26bc0f10e9130cd0d479b0b9f5f609",
      "type": "WEB"
    },
    {
      "url": "https://github.com/fission/fission",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/fission/fission/releases/tag/v1.25.0",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2026-06-10T18:17:13Z",
    "github_reviewed_at": "2026-07-28T20:16:00Z"
  }
}