Console allows arbitrary exec in any pod of the pipeline-phase namespace

Summary

POST /api/apps/:pipeline/:phase/:app/console (server/src/apps/apps.controller.ts:247-304) passes the request-body podName/containerName/command verbatim to Kubernetes Exec.exec (server/src/kubernetes/kubernetes.service.ts:1179-1188) without verifying that the target pod belongs to the app in the URL path. The namespace is pipelineName-phaseName (server/src/apps/apps.service.ts:746), shared by all apps in the same pipeline phase, so any user with app:write can execute arbitrary commands inside any pod of that namespace — including pods of other users' apps.

Prerequisite: KUBERO_CONSOLE_ENABLED=true (the kubero install prompt "Enable Console Access to running containers" defaults to y).

Impact

Cross-app arbitrary container command execution (RCE) within the shared pipeline-phase namespace; chained with the JWT fallback issue, reachable by an unauthenticated attacker.

Reproduction

With console enabled and an app:write token:

POST /api/apps/<pipeline>/<phase>/<app>/console
Authorization: Bearer <app:write token>
{"podName":"<other-app-pod-in-same-pipeline-phase>","containerName":"main","command":["sh","-c","id"]}

The command executes in the pod even though it does not belong to the <app> in the URL.

Negative controls: console disabled -> 400; no app:write -> 403.

Suggested fix

1. Before exec, confirm via pod labels that podName/containerName belong to the app.
2. Restrict console to the admin role or add resource-level authorization.
3. Consider a command allowlist / forbid interactive shells.

Start with the console handler in server/src/apps/apps.controller.ts:247-304 and the Kubernetes exec call in server/src/kubernetes/kubernetes.service.ts:1179-1188; check how app and pod labels are represented, with namespace construction in server/src/apps/apps.service.ts:746. Reproduce the request with another app's pod, then ensure execution is rejected unless the pod and container belong to the app in the URL, while preserving the documented disabled-console and permission behavior.