oss-security - [kubernetes] CVE-2020-8561: Webhook redirect in kube-apiserver

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 15 Sep 2021 21:21:53 +0000
From: "Hausler, Micah" <mhausler@...zon.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: [kubernetes] CVE-2020-8561: Webhook redirect in kube-apiserver

Hello Kubernetes Community,

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

This issue has been rated Medium (https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) (4.1), and assigned CVE-2020-8561
Am I vulnerable?

You may be vulnerable if `--profiling` is enabled on the kube-apiserver and actors who control a validating or mutating webhook can access the kube-apiserver process logs.
Affected Versions

This issue affects all known versions of kube-apiserver. 
How do I mitigate this vulnerability?

This issue can be mitigated by not allowing kube-apiserver access to sensitive resources or networks, or to reduce the “-v” flag value to less than 10 and set the “--profiling” flag value to “false” (default value is “true”). Setting the profiling flag to “false” prevents users from dynamically modifying the kube-apiserver log level, and the flag value Webhook requests may still be redirected to private networks with a log level less than 10, but the response body will not be logged.
Fixed Versions

There is no fix for this issue at this time.
Detection

Examining kube-apiserver log responses is the only known method of detection for this issue.

If you find evidence that this vulnerability has been exploited, please contact security@...ernetes.io
Additional Details

See the GitHub issue for more details: https://github.com/kubernetes/kubernetes/issues/104720
Acknowledgements

This vulnerability was reported by QiQi Xu

Thank You,

Micah Hausler on behalf of the Kubernetes Security Response Committee

Content of type "text/html" skipped

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4700 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.