CVE-2023-3893
📋 TL;DR
This vulnerability allows users with pod creation permissions on Windows nodes running kubernetes-csi-proxy to escalate privileges to admin/root level on those nodes. Only Kubernetes clusters with Windows nodes running kubernetes-csi-proxy are affected. The issue stems from improper input validation in the CSI proxy service.
💻 Affected Systems
- Kubernetes
- kubernetes-csi-proxy
📦 What is this software?
Csi Proxy by Kubernetes
Csi Proxy by Kubernetes
⚠️ Risk & Real-World Impact
Worst Case
An attacker with pod creation access gains full administrative control over Windows nodes, potentially compromising the entire cluster through lateral movement.
Likely Case
Malicious or compromised users with pod creation permissions escalate privileges to control Windows nodes and access sensitive workloads.
If Mitigated
With proper RBAC controls limiting pod creation and network segmentation, impact is limited to isolated Windows nodes.
🎯 Exploit Status
Exploitation requires authenticated access to create pods on Windows nodes. The vulnerability is in the CSI proxy service that runs with elevated privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: kubernetes-csi-proxy v1.1.3
Vendor Advisory: https://groups.google.com/g/kubernetes-security-announce/c/lWksE2BoCyQ
Restart Required: Yes
Instructions:
1. Update kubernetes-csi-proxy to version 1.1.3 or later on all Windows nodes. 2. Restart the kubernetes-csi-proxy service. 3. Verify the updated version is running.
🔧 Temporary Workarounds
Restrict Pod Creation Permissions
allImplement strict RBAC controls to limit which users/service accounts can create pods on Windows nodes.
Disable kubernetes-csi-proxy on Windows Nodes
windowsIf CSI functionality is not required, disable the kubernetes-csi-proxy service on Windows nodes.
Stop-Service kubernetes-csi-proxy
Set-Service kubernetes-csi-proxy -StartupType Disabled
🧯 If You Can't Patch
- Implement strict RBAC to limit pod creation to trusted users/service accounts only
- Segment Windows nodes into isolated network zones to limit lateral movement
🔍 How to Verify
Check if Vulnerable:
Check kubernetes-csi-proxy version on Windows nodes: 'Get-Service kubernetes-csi-proxy' and verify version is below 1.1.3Check Version:
Get-Service kubernetes-csi-proxy | Select-Object -ExpandProperty VersionVerify Fix Applied:
Verify kubernetes-csi-proxy version is 1.1.3 or higher: 'Get-Service kubernetes-csi-proxy | Select-Object -ExpandProperty Version'📡 Detection & Monitoring
Log Indicators:
- Unusual pod creation events on Windows nodes
- Privilege escalation attempts in Windows event logs
- kubernetes-csi-proxy service errors or crashes
Network Indicators:
- Unusual outbound connections from Windows nodes after pod creation
- Lateral movement attempts from Windows nodes
SIEM Query:
source="windows-security" EventCode=4688 NewProcessName="*powershell*" OR NewProcessName="*cmd*" AND SubjectUserName="SYSTEM"🔗 References
- https://github.com/kubernetes/kubernetes/issues/119594
- https://groups.google.com/g/kubernetes-security-announce/c/lWksE2BoCyQ
- https://security.netapp.com/advisory/ntap-20231221-0004/
- https://github.com/kubernetes/kubernetes/issues/119594
- https://groups.google.com/g/kubernetes-security-announce/c/lWksE2BoCyQ
- https://security.netapp.com/advisory/ntap-20231221-0004/
