Описание
Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.
A flaw was found in Kyverno. This server-side request forgery (SSRF) vulnerability in apiCall.service.url allows authenticated users to send arbitrary HTTP requests. By injecting user-controlled input through variable substitution, attackers can target internal services, cloud metadata endpoints, and loopback addresses. The response data is reflected in admission error messages, enabling non-blind data exfiltration, which means sensitive information can be disclosed.
Отчет
This vulnerability is rated Important because authenticated users can exploit a Server-Side Request Forgery (SSRF) in Kyverno's apiCall.service.url via variable substitution. This allows attackers to make arbitrary HTTP requests to internal services, cloud metadata endpoints, and loopback addresses, leading to information disclosure through admission error messages.
Меры по смягчению последствий
Ensure that no policy interpolates request-controlled data into apiCall.service.url. Audit all Policy, ClusterPolicy, and GlobalContextEntry resources for {{ }} expressions in that field and replace them with static URLs. Where a dynamic value is genuinely required, move it into the request body or a header rather than the URL, or constrain it to a fixed allowlist of permitted values before substitution. Enforce this going forward with a ValidatingAdmissionPolicy that rejects policies containing variable substitution in apiCall.service.url.
Дополнительная информация
Статус:
7.7 High
CVSS3
Связанные уязвимости
Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.
Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.
7.7 High
CVSS3