CVE-2020-35209

Vulnerability

Atomix v3.1.5, a Kubernetes toolkit for distributed applications, allows unauthorized Atomix nodes to join a target cluster by providing configuration information [1]. The issue lies in the cluster membership mechanism, which does not enforce authentication or validation of joining nodes. The affected versions include Atomix v3.1.5.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious Atomix node that submits configuration data to the target cluster. No prior authentication or special network position is required beyond network access to the cluster's communication channel. The attacker simply provides the necessary configuration details to be accepted as a member node.

Impact

An attacker who successfully joins the cluster gains unauthorized access to the distributed system. This can lead to data disruption, service instability, or potential manipulation of the cluster's state, compromising the integrity and availability of applications relying on Atomix.

Mitigation

No official patch or fixed version is mentioned in the available references [1][2]. Users should restrict network access to the cluster to trusted nodes only and monitor for unexpected cluster membership changes. If feasible, consider upgrading to a newer version of Atomix where this issue may be addressed.