mcp-server-semgrep/semgrep-rules/yaml/kubernetes/security/allow-privilege-escalation.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: allow-privilege-escalation
  patterns:
  - pattern-inside: |
      containers:
        ...
  - pattern-inside: |
      - name: $CONTAINER
        ...
  - pattern: |
      image: ...
      ...
  - pattern-inside: |
      image: ...
      ...
      $SC:
        ...
  - metavariable-regex:
      metavariable: $SC
      regex: ^(securityContext)$
  - pattern-not-inside: |
      image: ...
      ...
      securityContext:
        ...
        allowPrivilegeEscalation: $VAL
  - focus-metavariable: $SC
  fix: |
    securityContext:
      allowPrivilegeEscalation: false #
  message: >-
    In Kubernetes, each pod runs in its own isolated environment with its own
    set of security policies. However, certain container images may contain
    `setuid` or `setgid` binaries that could allow an attacker to perform
    privilege escalation and gain access to sensitive resources. To mitigate
    this risk, it's recommended to add a `securityContext` to the container in
    the pod, with the parameter `allowPrivilegeEscalation` set to `false`.
    This will prevent the container from running any privileged processes and
    limit the impact of any potential attacks.
    By adding the `allowPrivilegeEscalation` parameter to your the
    `securityContext`, you can help to
    ensure that your containerized applications are more secure and less
    vulnerable to privilege escalation attacks.
  metadata:
    cwe:
    - 'CWE-732: Incorrect Permission Assignment for Critical Resource'
    owasp:
    - A05:2021 - Security Misconfiguration
    - A06:2017 - Security Misconfiguration
    references:
    - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation
    - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
    - https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt
    - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag
    category: security
    technology:
    - kubernetes
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
  languages: [yaml]
  severity: WARNING