Kubernetes Vulnerability CVE-2020-8561: Redirecting Kube-apiserver Requests to Private Networks
Summary
CVE-2020-8561: A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private net... Affects kubernetes across 7 version ranges.
< 1.20.5+really1.20.2-1
< 8b5a19147530eaac9476b0ab82980b4088bbc1b2
< 544b7f5b5cd8483cc60cd1844269b9a49ebc9c93
< 27522a29febbcc4badac257763044d0d90c11abd
< aea7bbadd2fc0cd689de94a54e5b7b758869d691
< b462a3fecd73ef2eb0474246b00f3346cb293b32
< e9e6d137615cdf3f1f03baeee8ddc8601fc7e79a
Fixed in 1.20.5+really1.20.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kubernetes is an open-source container orchestration platform designed to automate the deployment, scaling, and management of containerized applications. It provides a robust framework for managing microservices and is widely used in cloud-native environments. The platform's architecture includes various components, such as the kube-apiserver, which serves as the central management entity. This vulnerability specifically affects the MutatingWebhookConfiguration and ValidatingWebhookConfiguration features, which are critical for managing admission control in Kubernetes.
Vulnerability Detail
A security issue was discovered in Kubernetes where actors controlling the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests can redirect kube-apiserver requests to private networks. If an attacker can view kube-apiserver logs at a high log level (level 10), they can access redirected responses and headers, potentially exposing sensitive information and compromising the security of the Kubernetes cluster.
How To Fix
Minimum fixed version
1.20.5+really1.20.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade kubernetesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can lower the log level of kube-apiserver to prevent sensitive information from being logged. This can be done by modifying the kube-apiserver configuration file and setting the log level to a lower value, such as 1 or 2. For example, add the following flag to the kube-apiserver command: '--v=2'.
Conclusion
CVE-2020-8561 is a significant vulnerability in Kubernetes that can lead to unauthorized access to sensitive information through kube-apiserver logs. It is crucial for users to upgrade to the patched version and consider temporary workarounds to mitigate risks until the upgrade can be performed.
See every vulnerability recorded for kubernetes →
FAQ
CVE-2020-8561 is a security vulnerability in Kubernetes that allows attackers to redirect kube-apiserver requests to private networks, potentially exposing sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability could allow unauthorized users to access sensitive information from kube-apiserver logs, leading to potential data breaches and security compromises.
The recommended action is to upgrade Kubernetes to version 1.20.5+really1.20.2-1 or later to ensure that the vulnerability is patched.
Yes, you can lower the log level of kube-apiserver to prevent sensitive information from being logged, which can reduce the risk of information exposure.
Related vulnerabilities
Recent vulnerabilities recorded for kubernetes.
