Is CVE-2020-8561 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-8561 being exploited in the wild.

How severe is CVE-2020-8561?

Medium severity, with a CVSS score of 4.1, published 21 September 2021.

Which products and versions are affected?

k8s.io/kubernetes (Go) <= 1.22.2, SEMVER:introduced=0,last_affected=1.22.2; Kubernetes <= 1.22.2.

Is there a fix for CVE-2020-8561?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2020-8561 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2020-8561?

Check whether you run k8s.io/kubernetes (Go) or Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-8561: Kubernetes kube-apiserver confused deputy in webhook configurations

Q: Is there a fix for CVE-2020-8561?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2020-8561 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2020-8561?

Check whether you run k8s.io/kubernetes (Go) or Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-8561 · Severity: medium · CVSS 4.1 · Published 2021-09-21

A security vulnerability exists in Kubernetes where administrative users who manage webhook configurations can trick the system into sending requests to internal, private networks. If these users also have access to system logs while high-detail logging is enabled, they could potentially view sensitive data from those internal responses. This could lead to the exposure of internal service information or credentials that are otherwise protected from external access.

Technologies: k8s.io/kubernetes (Go), Kubernetes. Vendors: Go, Kubernetes.

Quick answers

Is CVE-2020-8561 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-8561 being exploited in the wild.
How severe is CVE-2020-8561?: Medium severity, with a CVSS score of 4.1, published 21 September 2021.
Which products and versions are affected?: k8s.io/kubernetes (Go) <= 1.22.2, SEMVER:introduced=0,last_affected=1.22.2; Kubernetes <= 1.22.2.
Is there a fix for CVE-2020-8561?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2020-8561 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2020-8561?: Check whether you run k8s.io/kubernetes (Go) or Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A 'Confused Deputy' vulnerability (CWE-441) exists in the Kubernetes kube-apiserver. Attackers with high privileges who can control MutatingWebhookConfiguration or ValidatingWebhookConfiguration responses can redirect kube-apiserver requests to the apiserver's private networks. If the attacker also has permission to view kube-apiserver logs and the log level is set to 10 (extreme debug), they can capture redirected response bodies and headers. The vulnerability is exacerbated if profiling is enabled, as it may allow dynamic modification of log levels. No official patch is available; mitigation involves restricting apiserver network access, disabling profiling, and maintaining log levels below 10.

Affected products

Kubernetes Kubernetes <= 1.22.2

Identifiers

CVE-2020-8561
GHSA-74j8-88mm-7496

Timeline

2020-08-28: other: CVE reserved date
2021-09-01: disclosed: Issue opened in Kubernetes GitHub repository
2021-09-21: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.