oss-security - [kubernetes] CVE-2022-3172: Aggregated API server can cause clients to be redirected (SSRF)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CALrOjABKUtfOem9bF=La6qnf3GFkEKTngeb95MWRDYSGNYfHCA@mail.gmail.com>
Date: Fri, 16 Sep 2022 15:41:32 -0400
From: Monis Khan <i@...is.app>
To: oss-security@...ts.openwall.com
Subject: [kubernetes] CVE-2022-3172: Aggregated API server can cause clients
 to be redirected (SSRF)

Hello Kubernetes Community,

A security issue was discovered in kube-apiserver that allows an aggregated
API server to redirect client traffic to any URL. This could lead to the
client performing unexpected actions as well as forwarding the client's API
server credentials to third parties.

This issue has been rated *medium* (
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L)
(5.1), and assigned *CVE-2022-3172*
Am I vulnerable?

All Kubernetes clusters with the following versions that are running
aggregated API servers are impacted. To identify if you have aggregated API
servers configured, run the following command:

kubectl get apiservices.apiregistration.k8s.io -o=jsonpath='{range
.items[?(@.spec.service)]}{.metadata.name}{"\n"}{end}'

Affected Versions

   - kube-apiserver v1.25.0
   - kube-apiserver v1.24.0 - v1.24.4
   - kube-apiserver v1.23.0 - v1.23.10
   - kube-apiserver v1.22.0 - v1.22.13
   - kube-apiserver <= v1.21.14

How do I mitigate this vulnerability?

Aside from upgrading, no direct mitigation is available.

Aggregated API servers are a trusted part of the Kubernetes control plane,
and configuring them is a privileged administrative operation. Ensure that
only trusted cluster administrators are allowed to create or modify
APIService configuration, and follow security best practices with any
aggregated API servers that may be in use.
Fixed Versions

   - kube-apiserver v1.25.1
   - kube-apiserver v1.24.5
   - kube-apiserver v1.23.11
   - kube-apiserver v1.22.14

*Fix impact:* The fix blocks all 3XX responses from aggregated API servers
by default. This may disrupt an aggregated API server that relies on
redirects as part of its normal function. If all current and future
aggregated API servers are considered trustworthy and redirect
functionality is required, set the
--aggregator-reject-forwarding-redirect Kubernetes
API server flag to false to restore the previous behavior.

To upgrade, refer to the documentation:
https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade
Detection

Kubernetes audit log events indicate the HTTP status code sent to the
client via the responseStatus.code field. This can be used to detect if an
aggregated API server is redirecting clients.

If you find evidence that this vulnerability has been exploited, please
contact security@...ernetes.io
Additional Details

See the GitHub issue for more details:
https://github.com/kubernetes/kubernetes/issues/112513
Acknowledgements

This vulnerability was reported by Nicolas Joly & Weinong Wang @weinong
from Microsoft.

The issue was fixed and coordinated by Di Jin @jindijamie @enj @liggitt
@lavalamp @deads2k and @puerco.

Thank You,

Mo Khan on behalf of the Kubernetes Security Response Committee

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.