Node address isn't always verified when proxying
CVE-2022-3294

6.6MEDIUM

Key Information:

Vendor

Kubernetes
Status
Kubernetes
Vendor
CVE Published:
1 March 2023

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2022-3294?

Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Kubernetes <= unspecified

Kubernetes <= unspecified

Kubernetes <= unspecified

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2022-3294
Created by arbaaz29

References

https://groups.google.com/g/kubernetes-security-announce/...
https://github.com/kubernetes/kubernetes/issues/113757
https://security.netapp.com/advisory/ntap-20230505-0007/

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuval Avrahami of Palo Alto Networks
JSON
.