Kubernetes up to 1.11.9/1.12.7/1.13.5/1.14.0 Command link following

Summaryinfo

A vulnerability was found in Kubernetes up to 1.11.9/1.12.7/1.13.5/1.14.0. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the component Command Handler. The manipulation leads to link following. This vulnerability is documented as CVE-2019-1002101. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Kubernetes up to 1.11.9/1.12.7/1.13.5/1.14.0 (Virtualization Software). This issue affects an unknown function of the component Command Handler. The manipulation with an unknown input leads to a link following vulnerability. Using CWE to declare the problem leads to CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user?s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user?s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.

The bug was discovered 03/28/2019. The weakness was released 04/01/2019 (Website). It is possible to read the advisory at securityfocus.com. The identification of this vulnerability is CVE-2019-1002101 since 04/01/2019. Attacking locally is a requirement. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371721 (Kubernetes copy Directory Traversal Vulnerability).

Upgrading to version 1.11.9, 1.12.7, 1.13.5 or 1.14.0 eliminates this vulnerability.

Entry connected to this vulnerability is available at VDB-132670. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Virtualization Software

Name

• Kubernetes

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.11.0
• 1.11.1
• 1.11.2
• 1.11.3
• 1.11.4
• 1.11.5
• 1.11.6
• 1.11.7
• 1.11.8
• 1.11.9
• 1.12
• 1.12.0
• 1.12.1
• 1.12.2
• 1.12.3
• 1.12.4
• 1.12.5
• 1.12.6
• 1.12.7
• 1.13
• 1.13.0
• 1.13.1
• 1.13.2
• 1.13.3
• 1.13.4
• 1.13.5
• 1.14.0

License

• open-source

Website

• Product: https://github.com/kubernetes/kubernetes/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion