Auth bypass in Kubernetes
CVE-2019-11247
The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.021 (79.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Kubernetes — versions 1.10, 1.7, prior to 1.14.5
- Redhat Openshift_container_platform — versions 3.9, 3.10, 3.11
Weakness classification (CWE)
Public proof-of-concept exploits
- ARPSyndicate/cvemon
- adavarski/HomeLab-Proxmox-k8s-DevSecOps-playground
- adavarski/HomeLab-k8s-DevSecOps-playground
- atwilsecurity/k8s-Security
- cloudnative-security/hacking-kubernetes
- dli408097/k8s-security
- g3rzi/HackingKubernetes
- hacking-kubernetes/hacking-kubernetes.info
- magnologan/awesome-k8s-security
- rosyrut/K8S-Security
References
- jordan@liggitt.net (x_refsource_CONFIRM, Third Party Advisory)
- jordan@liggitt.net (mailing-list, x_refsource_MLIST, Third Party Advisory)
- jordan@liggitt.net (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- jordan@liggitt.net (x_refsource_CONFIRM, Third Party Advisory)
- jordan@liggitt.net (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- jordan@liggitt.net (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- jordan@liggitt.net (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-11247?
- CVE-2019-11247 is a high-severity vulnerability in Kubernetes, classified under Improper Input Validation. CVSS score: 8.1/10. Published 2019-08-29.
- How severe is CVE-2019-11247?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2019-11247 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.