Overview
Kubernetes (K8s) is a widely used open source container orchestration platform that automates the process of deploying, scaling, and managing containerized applications. Affected versions of this platform are vulnerable to a privilege escalation issue in which unprivileged requests are not fully terminated. This way, a remote attacker can elevate privileges and gain admin ownership of a cluster.
Details
The source of the CVE-2018-1002105 vulnerability is the Kubernetes API server, aka kube-apiserver, which is the central touchpoint where all Kubernetes operations are done. The API server is the gateway to the Kubernetes cluster, and it offers a wide range of capabilities by functioning as a reverse proxy to the kubelet deployed on the computing nodes. The server also functions as a reverse proxy when Kubernetes is extended using the aggregation layer. The aggregation layer enables the platform to be extended with other third-party APIs, beyond the ones provided by the built-in Kubernetes APIs. There are robust authentication and authorization mechanisms that safeguard access to the Kubernetes API server. However, this CVE enables a perpetrator to send valid, authorized request to the API server and circumvent the authorization logic found in any sequenced request. This allows the attacker to elevate the victim’s privileges. Attackers can exploit this vulnerability in two different ways. First, they can use the normal pod exec/attach/portforward privileges of a normal authenticated user to increase privileges and become admins. Also, they can use the unauthenticated privileges of a remote user to access the system and elevate privileges via the aggregated API server. By default, any user (either unauthenticated or authenticated) can carry out discovery API calls, which can potentially lead to this privilege escalation.
Affected Environments
Here are the versions of Kubernetes affected by this CVE (their fixes are also provided): Kubernetes v1.0.x-1.9.x (no fix available) Kubernetes v1.10.0-1.10.10 (fixed in version 1.10.11) Kubernetes v1.11.0-1.11.4 (fixed in version 1.11.5) Kubernetes v1.12.0-1.12.2 (fixed in version 1.12.3)
Remediation
Disallow the use of all aggregated API servers Pass --anonymous-auth=false command to the Kubernetes API server to disable any anonymous requests Disallow pod exec/attach/portforward privileges for users who should not have full rights to access the kubelet API.
Prevention
Upgrade to the latest version of Kubernetes Implement security controls on every Kubernetes node
Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
What is a WS vulnerability ID? 
