Executive brief
Kubernetes, the industry-standard platform for managing containerized applications, contains a design flaw that allows users with basic permissions to intercept network traffic. By creating a specific type of network service, an attacker can redirect traffic intended for external IP addresses to their own malicious containers. This could lead to the theft of sensitive data or the disruption of communications between different parts of a corporate network.
Technical details
A design flaw in the Kubernetes API server allows for man-in-the-middle (MitM) attacks via unverified ownership of IP addresses. An attacker with permissions to create or edit Services and Pods can set the 'spec.externalIPs' field in a ClusterIP service to a target IP, causing the cluster to route traffic for that IP to the attacker's service. Additionally, if an attacker has the highly privileged permission to patch the 'status' of a LoadBalancer service, they can achieve a similar effect by modifying 'status.loadBalancer.ingress.ip'. This is a fundamental architectural issue with no direct code patch; mitigation requires using admission controllers (like the externalip-webhook) to restrict or allowlist the use of ExternalIPs.
Affected products
- Kubernetes Kubernetes <= 1.22.0
Timeline
- 2020-12-04: disclosed: Issue first opened on GitHub
- 2021-01-21: advisory: NVD publication date
- 2022-02-08: advisory: GitHub Advisory published
References
- https://github.com/kubernetes/kubernetes/issues/97076
- https://github.com/kubernetes/kubernetes/issues/97110
- https://groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8
- https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942@%3Ccommits.druid.apache.org%3E