Critical · published December 5, 2018
CVSS calls it critical at 9.8. It sits in the 99.7th percentile for exploit probability.
🔥 A crafty misuse of upgrade requests could let attackers chat directly with your backend servers — all without a password! Think of the kube-apiserver as a restaurant’s front desk that allows patrons to send food orders directly to the kitchen without ever checking the menu. If a sneaky diner slips in a special request, they could cook up something disastrous! An attacker could exploit this vulnerability to send arbitrary requests to your backend servers, using the Kubernetes API server's own TLS credentials. This means they could potentially access sensitive data or even manipulate backend services, leading to severe security breaches and data loss. Absolutely devastating!
Think of the kube-apiserver as a restaurant’s front desk that allows patrons to send food orders directly to the kitchen without ever checking the menu. If a sneaky diner slips in a special request, they could cook up something disastrous! This vulnerability stems from incorrect handling of error responses in the kube-apiserver for proxied upgrade requests, allowing crafted requests to bypass authentication and channel straight to backend servers with privileged access.
An attacker could exploit this vulnerability to send arbitrary requests to your backend servers, using the Kubernetes API server's own TLS credentials. This means they could potentially access sensitive data or even manipulate backend services, leading to severe security breaches and data loss. Absolutely devastating! Update to Kubernetes versions v1.10.11, v1.11.5, or v1.12.3 immediately to close this gaping hole. After patching, review your API server configurations to ensure no unauthorized access points remain. Don't wait — your security depends on it! You've got this! Follow these steps, and you'll have your Kubernetes environment locked down in no time. 🛡️