Kubernetes Remote Code Execution via Nodes/Proxy Get Permission(grahamhelton.com)

55 pointsby illithid06 bulan yang lalu4 comments

Kubernetes Remote Code Execution via Nodes/Proxy Get Permission

https://grahamhelton.com/blog/nodes-proxy-rce

4 comments

klooney6 bulan yang lalu

> nodes/proxy GET allows command execution when using a connection protocol such as WebSockets. This is due to the Kubelet making authorization decisions based on the initial WebSocket handshake’s request without verifying CREATE permissions are present for the Kubelet’s /exec endpoint requiring different permissions depending solely on the connection protocol.

That's rough

kodama-lens6 bulan yang lalu

It is a know problem. The strange part for me is that they fixed it in v1.35 with the FeatureGate AuthorizePodWebsocketUpgradeCreatePermission for pods but not for nodes which have a far greater attact vector. The author also references this:

> The same behavior was fixed elsewhere

It is a problem, but in order to exploit it you need a valid token and have public kubelet endpoints or need to compromise an service within the cluster that has the required RBAC permissions. So cluster admins can cat and check their RBAC

otterley5 bulan yang lalu

You don’t have to remotely compromise the service within the cluster. A supply-chain attack will do as well.

Cluelessidoit5 bulan yang lalu

This is what freaks me out about clawdbot/molbot (whatever it’s called now)