Impact
When running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services.
Patches
https://github.com/zalando/skipper/releases/tag/v0.24.0 disables Kubernetes ExternalName by default.
Workarounds
Developers can allow list targets of an ExternalName by using -kubernetes-only-allowed-external-names=true and allow list via regular expressions -kubernetes-allowed-external-name '^[a-z][a-z0-9-.]+[.].allowed.example$'
References
https://kubernetes.io/docs/concepts/services-networking/service/#externalname
Impact
Arbitrary code execution through lua filters.
The default skipper configuration before v0.23 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs they an read skipper secrets.
Kubernetes example (vulnerability is not limited to Kubernetes) lua function request(ctx, params) local file = io.open('/var/run/secrets/kubernetes.io/serviceaccount/token', 'r') if file then local token = file:read('all') file:close() error('[EXFIL] ' .. token) -- Exfiltrate via error logs end end
Patches
https://github.com/zalando/skipper/releases/tag/v0.23.0 disables Lua by default.
Workarounds
You can reduce support of how you can pass lua filter script data by providing config for lua sources https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources. For example -lua-sources=file will only be exploitable if the attacker can create a lua script file on the target system.
References
https://opensource.zalando.com/skipper/reference/scripts/#enable-and-disable-lua-sources
Impact
Skipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request.
Patches The problem was patched in version https://github.com/zalando/skipper/releases/tag/v0.13.237. Users need to upgrade to skipper >=v0.13.237.
Workarounds
Use dropRequestHeader("X-Skipper-Proxy") filter
References
https://github.com/zalando/skipper/releases/tag/v0.13.237
For more information If you have any questions or comments about this advisory:
Open an issue in https://github.com/zalando/skipper/issues/new/choose Chat with us in slack: https://app.slack.com/client/T029RQSE6/C82Q5JNH5
In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.