CVE-2018-1002105
📋 TL;DR
This vulnerability in Kubernetes allows attackers to bypass authentication and authorization controls by exploiting improper error handling in the kube-apiserver's proxy functionality. Attackers can establish connections to backend servers through the API server and send arbitrary requests authenticated with the API server's TLS credentials. All Kubernetes clusters running affected versions are vulnerable.
💻 Affected Systems
- Kubernetes
📦 What is this software?
Kubernetes by Kubernetes
Kubernetes by Kubernetes
Kubernetes by Kubernetes
Kubernetes by Kubernetes
Kubernetes by Kubernetes
Trident by Netapp
⚠️ Risk & Real-World Impact
Worst Case
Full cluster compromise allowing attackers to execute arbitrary commands, access sensitive data, deploy malicious workloads, and pivot to other systems using the API server's elevated privileges.
Likely Case
Unauthorized access to backend services, data exfiltration, privilege escalation within the cluster, and potential lateral movement to other components.
If Mitigated
Limited impact if network policies restrict API server access, RBAC is properly configured, and audit logging is enabled to detect suspicious proxy requests.
🎯 Exploit Status
Exploitation requires network access to the Kubernetes API server but no authentication. Multiple public proof-of-concept exploits exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.10.11, v1.11.5, v1.12.3 or later
Vendor Advisory: https://github.com/kubernetes/kubernetes/issues/71411
Restart Required: Yes
Instructions:
1. Backup your cluster configuration. 2. Upgrade kube-apiserver to patched version. 3. Restart kube-apiserver. 4. Verify other components are compatible with new API server version. 5. Test cluster functionality after upgrade.
🔧 Temporary Workarounds
Network Policy Restriction
allRestrict network access to kube-apiserver using firewall rules or network policies to limit exposure.
kubectl apply -f network-policy.yaml
API Server Authentication Hardening
linuxImplement additional authentication layers and rate limiting for API server requests.
Configure --client-ca-file, --requestheader-client-ca-file flags
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Kubernetes API server from untrusted networks
- Enable and monitor audit logging for all API server requests, particularly focusing on proxy/upgrade requests
🔍 How to Verify
Check if Vulnerable:
Check Kubernetes version: kubectl version --short | grep Server. If version is below v1.10.11, v1.11.5, or v1.12.3, you are vulnerable.Check Version:
kubectl version --short | grep ServerVerify Fix Applied:
After upgrade, verify version is at least v1.10.11, v1.11.5, or v1.12.3 using kubectl version --short. Test proxy functionality to ensure it works correctly.📡 Detection & Monitoring
Log Indicators:
- Unusual proxy requests in kube-apiserver logs
- Unexpected upgrade requests with error responses
- Requests to backend services from API server IP with unusual patterns
Network Indicators:
- Abnormal traffic patterns between API server and backend services
- Unexpected connections established through API server proxy
SIEM Query:
source="kube-apiserver" AND ("proxy" OR "upgrade") AND error🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
- http://www.openwall.com/lists/oss-security/2019/06/28/2
- http://www.openwall.com/lists/oss-security/2019/07/06/3
- http://www.openwall.com/lists/oss-security/2019/07/06/4
- http://www.securityfocus.com/bid/106068
- https://access.redhat.com/errata/RHSA-2018:3537
- https://access.redhat.com/errata/RHSA-2018:3549
- https://access.redhat.com/errata/RHSA-2018:3551
- https://access.redhat.com/errata/RHSA-2018:3598
- https://access.redhat.com/errata/RHSA-2018:3624
- https://access.redhat.com/errata/RHSA-2018:3742
- https://access.redhat.com/errata/RHSA-2018:3752
- https://access.redhat.com/errata/RHSA-2018:3754
- https://github.com/evict/poc_CVE-2018-1002105
- https://github.com/kubernetes/kubernetes/issues/71411
- https://groups.google.com/forum/#%21topic/kubernetes-announce/GVllWCg6L88
- https://security.netapp.com/advisory/ntap-20190416-0001/
- https://www.coalfire.com/The-Coalfire-Blog/December-2018/Kubernetes-Vulnerability-What-You-Can-Should-Do
- https://www.exploit-db.com/exploits/46052/
- https://www.exploit-db.com/exploits/46053/
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
- http://www.openwall.com/lists/oss-security/2019/06/28/2
- http://www.openwall.com/lists/oss-security/2019/07/06/3
- http://www.openwall.com/lists/oss-security/2019/07/06/4
- http://www.securityfocus.com/bid/106068
- https://access.redhat.com/errata/RHSA-2018:3537
- https://access.redhat.com/errata/RHSA-2018:3549
- https://access.redhat.com/errata/RHSA-2018:3551
- https://access.redhat.com/errata/RHSA-2018:3598
- https://access.redhat.com/errata/RHSA-2018:3624
- https://access.redhat.com/errata/RHSA-2018:3742
- https://access.redhat.com/errata/RHSA-2018:3752
- https://access.redhat.com/errata/RHSA-2018:3754
- https://github.com/evict/poc_CVE-2018-1002105
- https://github.com/kubernetes/kubernetes/issues/71411
- https://groups.google.com/forum/#%21topic/kubernetes-announce/GVllWCg6L88
- https://security.netapp.com/advisory/ntap-20190416-0001/
- https://www.coalfire.com/The-Coalfire-Blog/December-2018/Kubernetes-Vulnerability-What-You-Can-Should-Do
- https://www.exploit-db.com/exploits/46052/
- https://www.exploit-db.com/exploits/46053/
