QID 375921

Date Published: 2021-10-06

QID 375921: Kubernetes Improper Authorization Vulnerability

Kubernetes is an open-source container-orchestration system for automating deployment, scaling and management of containerized applications.
Affected version:
Kubernetes versions v1.22.0 - v1.22.1
Kubernetes versions v1.21.0 - v1.21.4
Kubernetes versions v1.20.0 - v1.20.10
Kubernetes versions prior to and including v1.19.14

QID Detection Logic:(Authenticated)
The QID uses 'kubectl version' command to check for vulnerable versions of Kubernetes and also checks if 'kube-apiserver' is running or not.

QID Detection Logic:(Unauthenticated)
The detection uses the response from requests HTTP GET /openapi/v2 and HTTP GET /version to check for the version of Kubernetes.

Successful exploitation of the vulnerability may allow an attacker to create a container with subpath volume mounts to access files and directories outside of the volume, including on the host filesystem.

  • CVSS V3 rated as Critical - 8.1 severity.
  • CVSS V2 rated as Medium - 5.5 severity.
    • Solution
    As patched version is not available, customers are advised to apply mitigation. For more information please visit here

    Workaround:
    To mitigate this vulnerability without upgrading kubelet, you can disable the VolumeSubpath feature gate on kubelet and kube-apiserver, and remove any existing Pods making use of the feature.
    You can also use admission control to prevent less-trusted users from running containers as root to reduce the impact of successful exploitation.

    Vendor References

    CVEs related to QID 375921

    CVE-2021-25741 |
    Software Advisories
    Advisory ID Software Component Link
    NA URL Logo groups.google.com/g/kubernetes-security-announce/c/nyfdhK24H7s
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].