Node address isn't always verified when proxying
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.25.4, 1.24.8, 1.23.14, 1.22.16
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Kubernetes Kubernetes
through v1.25.3; through v1.24.7; through v1.23.13; through v1.22.15
- github.com/kubernetes/kubernetesGo
From 1.25.0 · fixed in 1.25.4
- github.com/kubernetes/kubernetesGo
From 1.24.0 · fixed in 1.24.8
- github.com/kubernetes/kubernetesGo
From 1.23.0 · fixed in 1.23.14
- github.com/kubernetes/kubernetesGo
From 1.22.0 · fixed in 1.22.16
- k8s.io/kubernetesGo
From 1.22.0 · fixed in 1.22.16; From 1.23.0 · fixed in 1.23.14; From 1.24.0 · fixed in 1.24.8; From 1.25.0 · fixed in 1.25.4