The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the masters host network (such as link-local or loopback services).
Weakness
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Kubernetes | Kubernetes | * | 1.15.11 (excluding) |
| Kubernetes | Kubernetes | 1.16.0 (including) | 1.16.9 (excluding) |
| Kubernetes | Kubernetes | 1.17.0 (including) | 1.17.5 (excluding) |
| Kubernetes | Kubernetes | 1.18.0 (including) | 1.18.0 (including) |
| Red Hat OpenShift Container Platform 3.11 | RedHat | atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7 | * |
| Red Hat OpenShift Container Platform 4.2 | RedHat | openshift-0:4.2.36-202006211650.p0.git.0.1fe246f.el8 | * |
| Red Hat OpenShift Container Platform 4.3 | RedHat | openshift-0:4.3.25-202006060952.git.1.96c30f6.el7 | * |
| Red Hat OpenShift Container Platform 4.3 | RedHat | openshift4/ose-hyperkube:v4.3.25-202006081335 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift-0:4.4.0-202006061254.git.1.dc84fb4.el8 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-hyperkube:v4.4.0-202006080610 | * |
| Kubernetes | Ubuntu | eoan | * |
| Kubernetes | Ubuntu | focal | * |
| Kubernetes | Ubuntu | groovy | * |
| Kubernetes | Ubuntu | hirsute | * |
| Kubernetes | Ubuntu | impish | * |
| Kubernetes | Ubuntu | kinetic | * |
| Kubernetes | Ubuntu | lunar | * |
| Kubernetes | Ubuntu | mantic | * |
| Kubernetes | Ubuntu | oracular | * |
Related Attack Patterns
References
- http://www.openwall.com/lists/oss-security/2020/06/01/4
- http://www.openwall.com/lists/oss-security/2021/05/04/8
- https://github.com/kubernetes/kubernetes/issues/91542
- https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
- https://security.netapp.com/advisory/ntap-20200724-0005/
- http://www.openwall.com/lists/oss-security/2020/06/01/4
- http://www.openwall.com/lists/oss-security/2021/05/04/8
- https://github.com/kubernetes/kubernetes/issues/91542
- https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
- https://security.netapp.com/advisory/ntap-20200724-0005/