Loading
◆◆0

CVE-2021-25735 Kubernetes 准入机制绕过漏洞

PWNWIK.COM

,

影响版本

kube-apiserver v1.20.0 - v1.20.5
kube-apiserver v1.19.0 - v1.19.9
kube-apiserver <= v1.18.17

漏洞利用

通过执行组合操作将changeAllowed标签更改为true并添加一个新标签，触发该漏洞，新的值已被准入控制器覆盖： 

 labels:  
    test: test  
    changeAllowed: "true"

参考

https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass/

https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass/

https://github.com/darryk10/CVE-2021-25735

https://nvd.nist.gov/vuln/detail/CVE-2021-25735

https://cloud.google.com/kubernetes-engine/docs/security-bulletins

免费、自由、人人(PwnWiki.Com)可编辑的漏洞库