Main Vulnerability Database Vulnerabilities #VU16224

Privilege escalation in Kubernetes - CVE-2018-1002105

Published: December 4, 2018 / Updated: June 17, 2021

Vulnerability identifier: #VU16224

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1002105

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The weakness exists due to an error when handling proxy requests. With a specially crafted request, users that are authorized to establish a connection through the Kubernetes API server to a backend server can then send arbitrary requests over the same connection directly to that backend, authenticated with the Kubernetes API server’s TLS credentials used to establish the backend connection.

Affected software

Kubernetes
Red Hat OpenShift Container Platform
Opensuse
Fedora
kubernetes
origin

How to mitigate CVE-2018-1002105

The vulnerability has been fixed in the versions 1.10.11, 1.11.5, 1.12.3, 1.13.0-rc.1.

Kubernetes - addressed in versions 1.10.11, 1.11.5, 1.12.3, 1.13.0 rc1
kubernetes - addressed in versions 1.12.5-1.fc29, 1.12.5-2.fc29
origin - update to 3.11.1-1.fc29

Links to Public Exploits and PoC-codes

External References

https://github.com/kubernetes/kubernetes/issues/71411