CVE-2024-9486
📋 TL;DR
This vulnerability allows attackers to gain root access to Kubernetes nodes using default credentials that remain enabled in VM images built with Kubernetes Image Builder's Proxmox provider. Only Kubernetes clusters are affected if their nodes use VM images created via the Image Builder project with its Proxmox provider. The default credentials are enabled during the image build process and not disabled in the resulting images.
💻 Affected Systems
- Kubernetes Image Builder
📦 What is this software?
Image Builder by Kubernetes Sigs
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of Kubernetes cluster with root access to all nodes, enabling data theft, service disruption, and lateral movement across the entire infrastructure.
Likely Case
Unauthorized root access to individual nodes, allowing attackers to install malware, exfiltrate sensitive data, or disrupt container workloads.
If Mitigated
Limited impact if nodes are behind strict network controls, but credential exposure still presents significant risk.
🎯 Exploit Status
Exploitation requires knowledge of default credentials and network access to affected nodes. No special tools or advanced techniques needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.1.38 and later
Vendor Advisory: https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ
Restart Required: Yes
Instructions:
1. Update Kubernetes Image Builder to v0.1.38 or later. 2. Rebuild all VM images using the updated Image Builder. 3. Replace existing nodes with newly built images. 4. Ensure old images are removed from Proxmox templates.
🔧 Temporary Workarounds
Change default credentials manually
linuxManually change or disable default credentials on all affected nodes
# Change root password
passwd root
# Disable password authentication in SSH
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd
Network isolation
linuxRestrict network access to affected nodes using firewall rules
# Example iptables rule to restrict SSH access
iptables -A INPUT -p tcp --dport 22 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected nodes from untrusted networks
- Deploy host-based intrusion detection systems to monitor for credential usage and unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check if nodes were deployed using VM images built with Kubernetes Image Builder v0.1.37 or earlier with Proxmox provider. Review image build logs or metadata for Image Builder version.Check Version:
Check image-builder version in build configuration or deployment manifestsVerify Fix Applied:
Verify Image Builder version is v0.1.38+. Test SSH access with default credentials should fail. Check that new images have credential hardening applied.📡 Detection & Monitoring
Log Indicators:
- Failed SSH authentication attempts with default usernames
- Successful SSH logins from unexpected sources
- Root login events from non-standard locations
Network Indicators:
- SSH connections to nodes from unauthorized IP addresses
- Unusual outbound connections from nodes after SSH access
SIEM Query:
source="auth.log" AND ("Failed password for root" OR "Accepted password for root") | stats count by src_ip