CVE-2019-11251 kubectl cp allows symlink directory traversal
A malicious container can use symlinks in kubectl cp to write files outside the destination directory, allowing attackers to modify arbitrary files on the host.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-11251?
CVE-2019-11251 is a medium-severity path traversal vulnerability in Kubernetes Kubernetes, published on 3 Feb 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.
Which versions are affected by CVE-2019-11251?
7 open source packages ship an affected version, including k8s.io/kubernetes. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/kubernetes Go | From 1.13.10 | 1.13.11, 1.14.7, 1.16.0 |
k8s.io/kubernetes Go | From 1.13.10 | 1.13.11 |
k8s.io/kubernetes Go | From 1.13.10 | 1.13.11 |
k8s.io/kubernetes Go | From 1.14.6 | 1.14.7 |
k8s.io/kubernetes Go | From 1.14.6 | 1.14.7 |
k8s.io/kubernetes Go | From 1.15.3 | 1.16.0 |
1 more packages
k8s.io/kubernetes Go | From 1.15.3 | 1.16.0 |
Linux distribution packages (8)
openshift Red Hat:openshift:4.1::el7 | All versions | 0:4.1.21-201910220952.git.0.493dbf6.el7 |
openshift-clients Red Hat:openshift:4.1::el7 | All versions | 0:4.1.21-201910220952.git.0.493dbf6.el7 |
openshift-clients-redistributable Red Hat:openshift:4.1::el7 | All versions | 0:4.1.21-201910220952.git.0.493dbf6.el7 |
openshift-hyperkube Red Hat:openshift:4.1::el7 | All versions | 0:4.1.21-201910220952.git.0.493dbf6.el7 |
openshift Red Hat:openshift:4.1::el8 | All versions | 0:4.1.21-201910220952.git.0.493dbf6.el8 |
openshift-clients Red Hat:openshift:4.1::el8 | All versions | 0:4.1.21-201910220952.git.0.493dbf6.el8 |
openshift-clients-redistributable Red Hat:openshift:4.1::el8 | All versions | 0:4.1.21-201910220952.git.0.493dbf6.el8 |
openshift-hyperkube Red Hat:openshift:4.1::el8 | All versions | 0:4.1.21-201910220952.git.0.493dbf6.el8 |
Products include Kubernetes Kubernetes.
How do I fix CVE-2019-11251?
Upgrade k8s.io/kubernetes to a fixed version for your release line: 1.13.11, 1.14.7 or 1.16.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-11251 being exploited?
There is no known exploitation of CVE-2019-11251 in the wild and no public exploit code.
Other vulnerabilities in Kubernetes Kubernetes
- CVE-2018-1002105 Privilege Escalation in Kubernetes
- CVE-2017-1000056 Kubernetes Privilege Escalation
- CVE-2016-1906 Authorization bypass in Openshift
- CVE-2023-3676 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
- CVE-2023-3955 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
Sources
Also known as GHSA-6qfg-8799-r575, GO-2022-0802, RHSA-2019:3266.