Executive brief
A design flaw in Kubernetes allows users with limited permissions to redirect network traffic to unauthorized locations. By manipulating specific API resources, an attacker could bypass security controls to access internal backend services or sensitive endpoints they should not be able to reach. This issue affects the fundamental way Kubernetes handles network routing and requires manual configuration changes to mitigate.
Technical details
A confused deputy vulnerability exists in Kubernetes due to the way Endpoint and EndpointSlice permissions are handled. Attackers with 'create' or 'edit' permissions for these resources can direct LoadBalancer or Ingress implementations to expose backend IPs that should be restricted. If the target's NetworkPolicy trusts the LoadBalancer or Ingress, this can bypass cross-namespace security controls and LoadBalancerSourceRanges. A similar attack vector exists for Ingress implementations that support forwarding to ExternalName Services. As this is a design flaw, no software patch is available; mitigation requires restricting write access to Endpoints and EndpointSlices by updating RBAC roles such as 'system:aggregate-to-edit'.
Affected products
- Kubernetes Kubernetes <= 1.22.2
Timeline
- 2021-07-14: disclosed: Issue opened on Kubernetes GitHub repository
- 2021-09-20: advisory: NVD publication date
- 2021-09-21: advisory: GitHub Advisory published