Server-Side Request Forgery (SSRF) in Kubernetes - CVE-2022-3172

Vulnerability identifier: #VU67554

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2022-3172

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in kube-apiserver. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Kubernetes
Migration Toolkit for Containers
IBM Edge Application Manager
Red Hat OpenShift Container Platform
Multicluster Engine for Kubernetes
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Service Mesh
Ansible Automation Platform
Red Hat Migration Toolkit for Applications
Netcool Operations Insight
IBM MQ Operator
IBM Fusion HCI
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
openEuler
toolbox (Red Hat package)
kubernetes-help
kubernetes
kubernetes-kubelet
kubernetes-kubeadm
kubernetes-client
kubernetes-node
kubernetes-master
cri-o (Red Hat package)
haproxy (Red Hat package)
jenkins (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
jenkins-2-plugins (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
IBM i Modernization Engine for Lifecycle Integration
Database Operator for FoundationDB
DB2 Warehouse on Cloud Pak for Data
Red Hat OpenShift on IBM Cloud
IBM supplied MQ Advanced container images
IBM Sterling Order Management
IBM DB2

Install updates from vendor's website.

Kubernetes - addressed in versions 1.22.14, 1.23.11, 1.24.5, 1.25.1
Migration Toolkit for Containers - addressed in versions 1.7.7, 1.7.8
Multicluster Engine for Kubernetes - update to 2.2.4
Red Hat OpenShift Container Platform - addressed in versions 4.10.56, 4.11.12, 4.12.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.12.4
Red Hat Migration Toolkit for Applications - update to 6.1.0
toolbox (Red Hat package) - update to 0.0.9-1.rhaos4.10.el8
IBM i Modernization Engine for Lifecycle Integration - update to 1.4
Netcool Operations Insight - update to 1.6.10
kubernetes-help - update to 1.20.2-9
kubernetes - update to 1.20.2-9
kubernetes-kubelet - update to 1.20.2-9
kubernetes-kubeadm - update to 1.20.2-9
kubernetes-client - update to 1.20.2-9
kubernetes-node - update to 1.20.2-9
kubernetes-master - update to 1.20.2-9
cri-o (Red Hat package) - addressed in versions 1.23.5-8.rhaos4.10.gitcc8441d.el7, 1.23.5-8.rhaos4.10.gitcc8441d.el8
IBM MQ Operator - addressed in versions 2.0.12, 2.4.0
haproxy (Red Hat package) - update to 2.2.19-4.el8
OpenShift Service Mesh - update to 2.4.0
IBM Fusion HCI - update to 2.7.0
jenkins (Red Hat package) - update to 2.387.1.1680701869-1.el8
Database Operator for FoundationDB - update to 4.6
DB2 Warehouse on Cloud Pak for Data - update to 4.6
IBM DB2 - update to 4.6
openshift (Red Hat package) - addressed in versions 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7, 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.10.0-202304032041.p0.g3a7500d.assembly.stream.el7, 4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8
Red Hat OpenShift on IBM Cloud - addressed in versions 4.10.56, 4.11.12, 4.12.2
jenkins-2-plugins (Red Hat package) - update to 4.10.1680703106-1.el8
kernel (Red Hat package) - update to 4.18.0-305.85.1.el8_4
kernel-rt (Red Hat package) - update to 4.18.0-305.85.1.rt7.157.el8_4
IBM supplied MQ Advanced container images - addressed in versions 9.3.0.5-r3, 9.3.3.0-r1
IBM Sterling Order Management - update to 10.0.0.29
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.15, 22.0.1.5
IBM Robotic Process Automation - update to 21.0.6

• https://github.com/kubernetes/kubernetes/issues/112513
• https://seclists.org/oss-sec/2022/q3/207

• SSRF in Kubernetes kube-apiserver
• SSRF in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Server-side request forgery in IBM Sterling Order Management
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.10
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• SSRF in OpenShift Container Platform 4.11
• Server-Side Request Forgery (SSRF) in IBM Edge Application Manager
• Server-side request forgery in Red Hat OpenShift on IBM Cloud
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.2
• OpenShift Data Foundation 4.12 update for kube-apiserver
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.4
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4
• Multiple vulnerabilities in IBM Storage Fusion
• Multiple vulnerabilities in Netcool Operations Insight
• openEuler update for kubernetes
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9
• IBM Database Operator for FoundationDB update for kube-apiserver