CVE-2020-8555: Kubernetes kube-controller-manager SSRF
A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master's host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).
Other sources
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
There exists a Server Side Request Forgery (SSRF) vulnerability in kube-controller-manager that allows certain authorized users to leak up to 500 bytes of arbitrary information from the master's host network, including secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).
An attacker with permissions to create a pod with certain built-in Volume types (GlusterFS, Quobyte, StorageFS, ScaleIO) or permissions to create a StorageClass can cause kube-controller-manager to make GET requests or POST requests without an attacker controlled request body from the master's host network.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.15.12 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.16.9 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.17.4 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.18.1 - Upgrade
Upgrade
redhat/atomic-openshiftto a version that resolves this vulnerability.Fixed in 0:3.11.232-1.git.0.a5bc32f.el7 - Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 0:4.2.36-202006211650.p0.git.0.1fe246f.el7 - Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 0:4.3.25-202006060952.git.1.96c30f6.el7 - Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 0:4.4.0-202006061254.git.1.dc84fb4.el8 - Upgrade
Upgrade
redhat/kube-controller-managerto a version that resolves this vulnerability.Fixed in 1.18.1 - Upgrade
Upgrade
redhat/kube-controller-managerto a version that resolves this vulnerability.Fixed in 1.17.5 - Upgrade
Upgrade
redhat/kube-controller-managerto a version that resolves this vulnerability.Fixed in 1.16.9 - Upgrade
Upgrade
redhat/kube-controller-managerto a version that resolves this vulnerability.Fixed in 1.15.12 - Upgrade
Upgrade
kubernetes kube-controller-managerto a version that resolves this vulnerability.Fixed in v1.15.12 - Upgrade
Upgrade
kubernetes kube-controller-managerto a version that resolves this vulnerability.Fixed in v1.16.9 - Upgrade
Upgrade
kubernetes kube-controller-managerto a version that resolves this vulnerability.Fixed in v1.17.5 - Upgrade
Upgrade
kubernetes kube-controller-managerto a version that resolves this vulnerability.Fixed in v1.18.0 - Configuration
Use RBAC to restrict who can write (create/update) StorageClass resources so only trusted users can create StorageClasses that may cause kube-controller-manager to make GET/POST requests for the SSRF-prone volume types.
Kubernetes RBAC Restrict StorageClass write permissions = Restrict create/update permissions to prevent authorized users from creating StorageClasses that can trigger SSRF in kube-controller-manager - Configuration
Restrict usage of the vulnerable volume types (GlusterFS, Quobyte, StorageFS, ScaleIO) so authorized users cannot create pods/volumes of these types that would cause kube-controller-manager to perform SSRF network requests.
Kubernetes admission policy/RBAC Restrict vulnerable volume type usage = Deny use of GlusterFS, Quobyte, StorageFS, ScaleIO (vulnerable to kube-controller-manager SSRF) - Compensating control
Restrict by RBAC both (1) StorageClass write permissions and (2) permissions to create/use the vulnerable volume types (GlusterFS, Quobyte, StorageFS, ScaleIO) to limit SSRF impact (leak up to 500 bytes from master's host network endpoints like link-local/loopback).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8555?
CVE-2020-8555 is a vulnerability in the Kubernetes kube-controller-manager that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints.
What is the severity of CVE-2020-8555?
The severity of CVE-2020-8555 is medium, with a CVSS score of 6.3.
How can I fix CVE-2020-8555?
To fix CVE-2020-8555, you need to upgrade to Kubernetes versions 1.15.12, 1.16.9, 1.17.5, or 1.18.1, depending on the affected version.
Where can I find more information about CVE-2020-8555?
You can find more information about CVE-2020-8555 at the following references: [CVE-2020-8555](https://www.cve.org/CVERecord?id=CVE-2020-8555), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-8555), [Kubernetes Security Announce](https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30), [Bugzilla Red Hat](https://bugzilla.redhat.com/show_bug.cgi?id=1821583), [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2020:2479).
What is the Common Weakness Enumeration (CWE) of CVE-2020-8555?
The CWEs associated with CVE-2020-8555 are CWE-918 (Server-Side Request Forgery) and CWE-200 (Information Exposure).