CVE-2020-8561: Confused Deputy in Kubernetes
Summary
CVE-2020-8561: Confused Deputy in Kubernetes. Affects k8s.io/kubernetes versions < 1.22.2. No fix is published. How to fix ↓
Also tracked for
- kubernetes · Debian:11
The same CVE-2020-8561 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications. It provides a robust and scalable infrastructure for running distributed systems. The vulnerability identified as CVE-2020-8561 affects the k8s.io/kubernetes package in the Go ecosystem. This package is a core component of Kubernetes and is responsible for handling MutatingWebhookConfiguration and ValidatingWebhookConfiguration requests. These requests allow users to modify or validate Kubernetes resources. However, due to a security flaw, actors with control over these requests can redirect kube-apiserver requests to private networks of the apiserver. This vulnerability can be exploited by users who have access to kube-apiserver logs with a log level set to 10, as they can view the redirected responses and headers in the logs.
Vulnerability Detail
The vulnerability arises from a confused deputy scenario in Kubernetes. Actors with control over MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests can manipulate the responses and redirect kube-apiserver requests to private networks. This can lead to unauthorized access to sensitive information or resources within the private network. The impact of this vulnerability depends on the privileges of the actor exploiting it. If an actor with high privileges can view kube-apiserver logs, they can gain insight into the redirected responses and headers, potentially exposing sensitive data. The vulnerability has a CVSS score of 4.1, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can consider adjusting the log level configuration of kube-apiserver to a value lower than 10. This will prevent the redirected responses and headers from being logged. However, this workaround does not address the underlying vulnerability and should be seen as a temporary measure until the package is updated to a secure version.
Conclusion
The vulnerability CVE-2020-8561 in the k8s.io/kubernetes package of Kubernetes allows actors to redirect kube-apiserver requests to private networks, potentially leading to unauthorized access and exposure of sensitive information. To mitigate this vulnerability, it is crucial to upgrade the package to a secure version and adjust the log level configuration of kube-apiserver. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for k8s.io/kubernetes →
FAQ
Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications.
The k8s.io/kubernetes package is a core component of Kubernetes written in Go. It handles MutatingWebhookConfiguration and ValidatingWebhookConfiguration requests, allowing users to modify or validate Kubernetes resources.
The vulnerability allows actors to redirect kube-apiserver requests to private networks, potentially gaining unauthorized access to sensitive information or resources within the private network. It can also expose redirected responses and headers in kube-apiserver logs, which may contain sensitive data.
The vulnerability has a CVSS score of 4.1, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade the k8s.io/kubernetes package to a version beyond 1.22.2, which includes the necessary security patches. Additionally, adjusting the log level configuration of kube-apiserver can help limit the exposure of sensitive information in the logs.
Related vulnerabilities
Recent vulnerabilities recorded for k8s.io/kubernetes.
