Executive brief
grpc-ts-health-check is a Node.js library that provides health checking for gRPC services, commonly used in containerized environments like Kubernetes. An unauthenticated attacker can manipulate an exposed API endpoint to mark the service as unhealthy, causing Kubernetes to stop routing traffic to it and resulting in service unavailability.
Technical details
The vulnerability is an insecure API endpoint exposure in versions prior to 2.0.0 that allows unauthenticated clients to set the service health status to failing. This is a design flaw rather than a code injection or authentication bypass—the health check API accepts external requests without proper validation or access controls. An attacker with network access to the gRPC service can invoke the endpoint remotely to trigger a denial of service, as Kubernetes health probes will detect the failing status and remove the service from load balancing. The fix is available in version 2.0.0 and later.
Affected products
- grpc-ts-health-check grpc-ts-health-check prior to 2.0.0
Timeline
- 2020-09-03: disclosed