Skip to content

Missing agentk request validation could cause KAS to panic

With a change made during %17.0 (removing to send AgentMeta with the GetConfiguration gRPC call in Remove unused AgentMeta (gitlab-org/cluster-integration/gitlab-agent!1483 - merged)) we've discovered a potential DOS vulnerability. The issue is that we are missing a validation call to check if the data send by the agentk is valid. That missing validation call and in case of invalid data KAS panics and crashes. This behavior can be abused to DOS KAS.

Validation is missing since the introduction of the GetConfiguration() gRPC call back in 2020. It only became a problem in %16.10 with Keep track of active agent versions (gitlab-org/cluster-integration/gitlab-agent!1285 - merged).