3 ms·
> However, because the Admission Controller lacks authentication, an attacker with minimal network access could craft and send arbitrary AdmissionReview request
by Traubenfuchs 2y ago
> However, because the Admission Controller lacks authentication, an attacker with minimal network access could craft and send arbitrary AdmissionReview requests from any pod within the cluster.
Do I understand this correctly?
- To exploit this vulnerability, you need to send a request directly to a kubernetes resource, the admission controller, something that is generally not possible unless you have a misconfiguration on the level of "MySQL server is reachable from any external ip".
- Exploiting this vulnerability by communicating with the nginx server itself is not possible.
- Normally, kubernetes resources should never be accessible from the internet. This requires an obviously dangerous misconfiguration or extremely lax security standards. Ideally, no one should be able to tell you are using kubernetes from outside.
- kjs3 2y agoI think you've got it. But I'm on the fence about the rest. I mean, you're spot on that it would require a monumentally bad collection of misconfigurations to mount the attack and 9.8 seems to be somewhat histrionic. But considering how often I run into a monumentally bad collection of misconfigurations when doing incident post-mortems, I'm sorely tempted to be ok with assigning ratings with the assumption that the target has done all the compensating controls wrong. YMMV.
- INTPenis 2y agoI think they might be targeting cloud providers that expose such endpoints to their clients. I built clusters using ingress-nginx at my old job and I can guarantee you that not one single endpoint of k8s was accessible outside of NAT.
- Zacru 2y agoThis makes a SSRF bug go from "oops, that's bad" to "oops, your whole cluster is pwned", right?
- pcthrowaway 2y agoWell the attacker can be inside, or can infiltrate part of your network, then combine this attack to get control over your kubernetes deployment. Yes, if the call is coming from inside the house, you're already in a bad spot, but going beyond capabilities like DDoS and network traversal (such as also gaining the ability to enumerate the secrets in your k8s) is quite a bit worse. Also, a public-facing running in the cluster itself could have a vulnerability that, combined with this bug, gives an attacker much further reach.