Executive brief
A security vulnerability exists in Kubernetes where administrative users who manage webhook configurations can trick the system into sending requests to internal, private networks. If these users also have access to system logs while high-detail logging is enabled, they could potentially view sensitive data from those internal responses. This could lead to the exposure of internal service information or credentials that are otherwise protected from external access.
Technical details
A 'Confused Deputy' vulnerability (CWE-441) exists in the Kubernetes kube-apiserver. Attackers with high privileges who can control MutatingWebhookConfiguration or ValidatingWebhookConfiguration responses can redirect kube-apiserver requests to the apiserver's private networks. If the attacker also has permission to view kube-apiserver logs and the log level is set to 10 (extreme debug), they can capture redirected response bodies and headers. The vulnerability is exacerbated if profiling is enabled, as it may allow dynamic modification of log levels. No official patch is available; mitigation involves restricting apiserver network access, disabling profiling, and maintaining log levels below 10.
Affected products
- Kubernetes Kubernetes <= 1.22.2
Timeline
- 2020-08-28: other: CVE reserved date
- 2021-09-01: disclosed: Issue opened in Kubernetes GitHub repository
- 2021-09-21: advisory: GitHub Advisory published