Crossplane vulnerable to possible image tampering from missing image validation for Packages

Vulnerability

Crossplane is a framework for building cloud-native control planes. In versions prior to 1.11.5, 1.12.3, and 1.13.0, the image backend does not validate the byte contents of Crossplane packages [1][4]. This means the software does not detect if an attacker has tampered with a Package [4].

Exploitation

An attacker who can modify a Crossplane package image (e.g., by compromising a container registry or via man-in-the-middle during image pull) could deliver a malicious package. The vulnerability does not require authentication to exploit if the attacker can interfere with image delivery. Prerequisites include access to a registry or network position to alter the package bytes [1][4].

Impact

A successful attacker could inject arbitrary content into a Crossplane package, potentially leading to arbitrary code execution within the Crossplane control plane or installation of compromised resources [1]. The impact is limited to environments where packages from untrusted sources are consumed or where package creation privileges are misconfigured [4].

Mitigation

The vulnerability is fixed in Crossplane versions 1.11.5, 1.12.3, and 1.13.0 [1][4]. Users should upgrade to these or later versions. As a workaround, administrators should only use images from trusted sources and restrict package editing/creating privileges to administrators only [1][4].