CVE-2022-3172 Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)
An aggregated API server can redirect client traffic to arbitrary URLs, potentially exposing credentials and triggering unexpected actions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-3172?
CVE-2022-3172 is a medium-severity server-side request forgery vulnerability in Kubernetes kube-apiserver, published on 3 Nov 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.
Weakness: CWE-918
Which versions are affected by CVE-2022-3172?
It affects 1 product.
Linux distribution packages (2)
openshift Red Hat:openshift:4.11::el8 | All versions | 0:4.11.0-202210122157.p0.g5157800.assembly.stream.el8 |
openshift-hyperkube Red Hat:openshift:4.11::el8 | All versions | 0:4.11.0-202210122157.p0.g5157800.assembly.stream.el8 |
Products include Kubernetes Apiserver.
How do I fix CVE-2022-3172?
Apply the vendor's patch.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-3172 being exploited?
There is no known exploitation of CVE-2022-3172 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2022-3172, OESA-2022-1979, RHBA-2022:7200.