Is CVE-2020-8554 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-8554 being exploited in the wild.

How severe is CVE-2020-8554?

Medium severity, with a CVSS score of 5, published 8 February 2022.

Which products and versions are affected?

k8s.io/kubernetes (Go) <= 1.22.0, SEMVER:introduced=0,last_affected=1.22.0; Kubernetes <= 1.22.0.

Is there a fix for CVE-2020-8554?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2020-8554 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2020-8554?

Check whether you run k8s.io/kubernetes (Go) or Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-8554: Kubernetes traffic interception via unverified ExternalIPs ownership

Q: Is there a fix for CVE-2020-8554?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2020-8554 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2020-8554?

Check whether you run k8s.io/kubernetes (Go) or Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-8554 · Severity: medium · CVSS 5 · Published 2022-02-08

Kubernetes, the industry-standard platform for managing containerized applications, contains a design flaw that allows users with basic permissions to intercept network traffic. By creating a specific type of network service, an attacker can redirect traffic intended for external IP addresses to their own malicious containers. This could lead to the theft of sensitive data or the disruption of communications between different parts of a corporate network.

Technologies: k8s.io/kubernetes (Go), Kubernetes. Vendors: Go, Kubernetes.

Quick answers

Is CVE-2020-8554 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-8554 being exploited in the wild.
How severe is CVE-2020-8554?: Medium severity, with a CVSS score of 5, published 8 February 2022.
Which products and versions are affected?: k8s.io/kubernetes (Go) <= 1.22.0, SEMVER:introduced=0,last_affected=1.22.0; Kubernetes <= 1.22.0.
Is there a fix for CVE-2020-8554?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2020-8554 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2020-8554?: Check whether you run k8s.io/kubernetes (Go) or Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A design flaw in the Kubernetes API server allows for man-in-the-middle (MitM) attacks via unverified ownership of IP addresses. An attacker with permissions to create or edit Services and Pods can set the 'spec.externalIPs' field in a ClusterIP service to a target IP, causing the cluster to route traffic for that IP to the attacker's service. Additionally, if an attacker has the highly privileged permission to patch the 'status' of a LoadBalancer service, they can achieve a similar effect by modifying 'status.loadBalancer.ingress.ip'. This is a fundamental architectural issue with no direct code patch; mitigation requires using admission controllers (like the externalip-webhook) to restrict or allowlist the use of ExternalIPs.

Affected products

Kubernetes Kubernetes <= 1.22.0

Identifiers

CVE-2020-8554
GHSA-j9wf-vvm6-4r9w

Timeline

2020-12-04: disclosed: Issue first opened on GitHub
2021-01-21: advisory: NVD publication date
2022-02-08: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.