Kubernetes API Server Vulnerability: External IP Traffic Interception
Summary
CVE-2020-8554: Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Affects kubernetes across 6 version ranges.
< 1.31.4+ds-1
< 641856db18352033a0d96dbc99153fa3b27298e5
< 50809107cd47a1f62da362bccefdd9e6f7076145
< e8462b5b5dc2584fdcd18e6bcfe9f1e4d970a529
< f1cb295a73c9298232b9848aa1b4029e36fc91e5
< f6da02f583256d1a15cc44a101c80bfa2080a46f
Fixed in 1.31.4+ds-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kubernetes is an open-source container orchestration platform designed to automate the deployment, scaling, and management of containerized applications. It provides a robust framework for managing microservices and offers features such as load balancing, service discovery, and automated rollouts. However, certain versions of Kubernetes are susceptible to a vulnerability that allows unauthorized interception of traffic through misconfigured services.
Vulnerability Detail
The vulnerability, identified as CVE-2020-8554, exists in the Kubernetes API server across all versions. It allows an attacker with the ability to create a ClusterIP service and manipulate the spec.externalIPs field to intercept traffic directed to that IP address. Furthermore, if an attacker can patch the status of a LoadBalancer service—a privileged operation typically restricted to authorized users—they can set the status.loadBalancer.ingress.ip, leading to similar traffic interception. This vulnerability poses significant risks, including unauthorized access to sensitive data and potential service disruptions.
How To Fix
Minimum fixed version
1.31.4+ds-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade kubernetesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the use of external IPs in your Kubernetes services by implementing network policies that limit traffic to only trusted sources. Additionally, avoid granting users unnecessary permissions to modify service statuses.
Conclusion
CVE-2020-8554 represents a significant security risk for Kubernetes users, allowing unauthorized interception of traffic through misconfigured services. By implementing strict access controls, regularly auditing configurations, and upgrading to patched versions, users can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for kubernetes →
FAQ
CVE-2020-8554 is a vulnerability in the Kubernetes API server that allows unauthorized interception of traffic through misconfigured services.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit the Vulert playground to check for vulnerabilities without signup.
The vulnerability can lead to unauthorized access to sensitive data, service disruptions, and potential exploitation of the affected Kubernetes cluster.
Implement strict RBAC policies, regularly audit configurations, and upgrade to the latest patched version of Kubernetes to mitigate risks.
Yes, the CVSS score for CVE-2020-8554 is 5.0, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for kubernetes.
