CVE-2018-1002105 Privilege Escalation in Kubernetes
Attackers can send arbitrary requests to backend servers via the Kubernetes API server, potentially executing code or escalating privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1002105?
CVE-2018-1002105 is a critical server-side request forgery vulnerability in Kubernetes Kubernetes, published on 5 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.
Weakness: CWE-388
Which versions are affected by CVE-2018-1002105?
7 open source packages ship an affected version, including github.com/kubernetes/kubernetes. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kubernetes/kubernetes Go | All versions | 1.10.11, 1.11.5, 1.12.3 |
github.com/kubernetes/kubernetes Go | All versions | 1.10.11 |
github.com/kubernetes/kubernetes Go | All versions | 1.10.11 |
github.com/kubernetes/kubernetes Go | From 1.11.0 | 1.11.5 |
github.com/kubernetes/kubernetes Go | From 1.11.0 | 1.11.5 |
github.com/kubernetes/kubernetes Go | From 1.12.0 | 1.12.3 |
1 more packages
github.com/kubernetes/kubernetes Go | From 1.12.0 | 1.12.3 |
Linux distribution packages (33)
atomic-enterprise-service-catalog Red Hat:openshift:3.10::el7 | All versions | 1:3.10.72-1.git.1450.7d3f435.el7 |
atomic-enterprise-service-catalog-svcat Red Hat:openshift:3.10::el7 | All versions | 1:3.10.72-1.git.1450.7d3f435.el7 |
atomic-openshift Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.0.3cb2fdc.el7 |
atomic-openshift-clients Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.0.3cb2fdc.el7 |
atomic-openshift-clients-redistributable Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.0.3cb2fdc.el7 |
atomic-openshift-descheduler Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.299.953c1c8.el7 |
atomic-openshift-docker-excluder Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.0.3cb2fdc.el7 |
atomic-openshift-dockerregistry Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.390.186ec4f.el7 |
atomic-openshift-excluder Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.0.3cb2fdc.el7 |
atomic-openshift-hyperkube Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.0.3cb2fdc.el7 |
atomic-openshift-hypershift Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.0.3cb2fdc.el7 |
atomic-openshift-master Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.0.3cb2fdc.el7 |
atomic-openshift-node Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.0.3cb2fdc.el7 |
atomic-openshift-node-problem-detector Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.252.fa9e8ae.el7 |
atomic-openshift-pod Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.0.3cb2fdc.el7 |
atomic-openshift-sdn-ovs Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.0.3cb2fdc.el7 |
atomic-openshift-template-service-broker Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.0.3cb2fdc.el7 |
atomic-openshift-tests Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.0.3cb2fdc.el7 |
atomic-openshift-web-console Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.395.d23c438.el7 |
golang-github-prometheus-node_exporter Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.1060.64daa26.el7 |
openshift-ansible Red Hat:openshift:3.10::el7 | All versions | 0:3.10.73-1.git.0.8b65cea.el7 |
openshift-ansible-docs Red Hat:openshift:3.10::el7 | All versions | 0:3.10.73-1.git.0.8b65cea.el7 |
openshift-ansible-playbooks Red Hat:openshift:3.10::el7 | All versions | 0:3.10.73-1.git.0.8b65cea.el7 |
openshift-ansible-roles Red Hat:openshift:3.10::el7 | All versions | 0:3.10.73-1.git.0.8b65cea.el7 |
openshift-enterprise-cluster-capacity Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.380.0fd53e8.el7 |
openshift-monitor-project-lifecycle Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.59.5358725.el7 |
openshift-monitor-sample-app Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.5.de405bc.el7 |
prometheus-node-exporter Red Hat:openshift:3.10::el7 | All versions | 0:3.10.72-1.git.1060.64daa26.el7 |
atomic-openshift Red Hat:openshift:3.2::el7 | All versions | 0:3.2.1.34-2.git.20.6367d5d.el7 |
atomic-openshift-clients Red Hat:openshift:3.2::el7 | All versions | 0:3.2.1.34-2.git.20.6367d5d.el7 |
atomic-openshift-clients-redistributable Red Hat:openshift:3.2::el7 | All versions | 0:3.2.1.34-2.git.20.6367d5d.el7 |
atomic-openshift-docker-excluder Red Hat:openshift:3.2::el7 | All versions | 0:3.2.1.34-2.git.20.6367d5d.el7 |
atomic-openshift-dockerregistry Red Hat:openshift:3.2::el7 | All versions | 0:3.2.1.34-2.git.20.6367d5d.el7 |
Products include Kubernetes Kubernetes, Netapp Trident, Redhat Openshift Container Platform.
How do I fix CVE-2018-1002105?
Upgrade github.com/kubernetes/kubernetes to a fixed version for your release line: 1.10.11, 1.11.5 or 1.12.3.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2018-1002105 being exploited?
There is no known exploitation of CVE-2018-1002105 in the wild and no public exploit code.
Public exploit code: 2 Exploit-DB entries and 5 proofs of concept on GitHub.
Other vulnerabilities in Kubernetes Kubernetes
- CVE-2017-1000056 Kubernetes Privilege Escalation
- CVE-2016-1906 Authorization bypass in Openshift
- CVE-2023-3676 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
- CVE-2023-3955 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
- CVE-2021-25741 Symlink Exchange Can Allow Host Filesystem Access
Sources
Also known as DEBIAN-CVE-2018-1002105, GHSA-579h-mv94-g4gp, GO-2022-0792, RHSA-2018:3549, RHSA-2018:3551, RHSA-2018:3598 and 4 more.