RBAC Roles Allow Privilege Escalation

apiVersion: rules.spotter.dev/v1alpha1
kind: SpotterRule
metadata:
  name: spotter-access-001
  labels:
    severity: "critical"
    category: "access"
  annotations:
    rules.spotter.dev/title: "RBAC Roles Allow Privilege Escalation"
    rules.spotter.dev/version: "1.0.0"
    rules.spotter.dev/cwe: "CWE-269"
    rules.spotter.dev/description: "RBAC roles that grant `escalate` permissions can be abused to gain higher privileges."
spec:
  match:
    resources:
      kubernetes:
        apiGroups: ["rbac.authorization.k8s.io"]
        versions: ["v1"]
        kinds: ["Role", "ClusterRole"]
  cel: |
    object.kind in ["Role", "ClusterRole"] && has(object.rules) && object.rules.exists(r,
      has(r.resources) && has(r.verbs) &&
      r.resources.exists(res, res in ["roles", "clusterroles"]) &&
      r.verbs.exists(verb, verb in ["bind", "escalate", "*"])
    )
  remediation:
    manual: "Avoid granting `bind` & escalate` permissions in RBAC roles."
  references:
    - title: "Kubernetes RBAC"
      url: "https://kubernetes.io/docs/reference/access-authn-authz/rbac/"