[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[oss-security] [kubernetes] CVE-2020-8561: Webhook redirect in kube-apiserver



Hello Kubernetes Community,

 

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

 

This issue has been rated Medium (https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) (4.1), and assigned CVE-2020-8561

Am I vulnerable?

 

You may be vulnerable if `--profiling` is enabled on the kube-apiserver and actors who control a validating or mutating webhook can access the kube-apiserver process logs.

Affected Versions

 

This issue affects all known versions of kube-apiserver. 

How do I mitigate this vulnerability?

 

This issue can be mitigated by not allowing kube-apiserver access to sensitive resources or networks, or to reduce the “-v” flag value to less than 10 and set the “--profiling” flag value to “false” (default value is “true”). Setting the profiling flag to “false” prevents users from dynamically modifying the kube-apiserver log level, and the flag value Webhook requests may still be redirected to private networks with a log level less than 10, but the response body will not be logged.

Fixed Versions

 

There is no fix for this issue at this time.

Detection

 

Examining kube-apiserver log responses is the only known method of detection for this issue.

If you find evidence that this vulnerability has been exploited, please contact security AT kubernetes.io

Additional Details

 

See the GitHub issue for more details: https://github.com/kubernetes/kubernetes/issues/104720

Acknowledgements

 

This vulnerability was reported by QiQi Xu

 

Thank You,

 

Micah Hausler on behalf of the Kubernetes Security Response Committee

 

 

 

Attachment: smime.p7s
Description: S/MIME cryptographic signature