CVE-2024-45496: RCE in OpenShift Container Platform

The vulnerability allows an attacker with developer-level access to craft a malicious .gitconfig file. This file, when processed during the cloning phase, can inject commands that are executed with elevated privileges on the worker node. This effectively grants the attacker arbitrary command execution capabilities, potentially leading to complete system compromise. The attacker could install malware, steal sensitive data, or pivot to other systems within the network. The blast radius extends to the entire worker node and potentially the broader OpenShift cluster if the attacker can leverage this access for lateral movement.

1. Reserved2024-08-30
2. Published2024-09-17
3. Modified2025-01-09
4. EPSS updated2026-04-02

The primary mitigation is to immediately upgrade to OpenShift Container Platform version 0.0.0-alpha.0.0.20240911 or later. If upgrading is not immediately feasible, consider restricting access to the build process to trusted developers only. Implement strict input validation on any configuration files used during the build process to prevent malicious content injection. Monitor build logs for suspicious activity and unusual command executions. While a WAF is unlikely to directly address this, reviewing and hardening the build environment itself is crucial.