Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Kubernetes Vulnerability Puts Clusters at Risk of Takeover (CVE-2020-8558)

Summary: Unit 42 disclosed CVE-2020-8558, a flaw in kube-proxy's route_localnet setting that exposed nodes' localhost-only services to hosts on the local network and to pods on the node, with details public on April 18, 2020 and a patch released June 1, 2020. Where the api-server insecure-port was left enabled, an unauthenticated attacker on the master node's local network could reach it and gain full control of the cluster; Kubernetes rated the impact High in those clusters and Medium otherwise, and patched in v1.18.4, v1.17.7 and v1.16.11 on June 17, 2020.

What you should know: Every node in a cluster had route_localnet enabled by kube-proxy, and Kubernetes grants pods CAP_NET_RAW by default, so a single unauthenticated request to an exposed insecure-port was enough for an attacker to take over the cluster, steal data, deploy crypto miners, or remove services.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2020-8558
Related