FlyteConsole (cors_proxy endpoint): FlyteConsole's cors_proxy forwards attacker-chosen URLs, so anyone who reaches the

Impact

FlyteConsole's cors_proxy forwards attacker-chosen URLs, so anyone who reaches the console can make the server fetch internal endpoints on their behalf - most usefully the cloud instance metadata service. That yields the node's IAM role credentials, which on a GPU cluster generally unlock the object stores holding every tenant's datasets and checkpoints. Headers may be passed along to the attacker-chosen destination too.

Who can reach it

Any user who can reach FlyteConsole. Exploitable without authentication when the console is exposed to the internet.

What to do

Upgrade FlyteConsole to 0.52.0 or later, which removes cors_proxy entirely, and redeploy. As an interim measure take FlyteConsole off the internet. If the console was ever publicly reachable, rotate the node/pod IAM credentials it could have surfaced.

References