A new vulnerability has been discovered with Kubernetes, associated with a command injection vulnerability that leads to remote code execution with SYSTEM-level privileges on the compromised Windows node.
The vulnerability tracked as CVE-2023-5528 with a CVSS score of 7.2, to exploit this vulnerability it requires enormous efforts from the threat actors, including applying malicious YAML files to the cluster, access to create a persistent volume that can be utilized during the command injection process, and some level of user privilege on the affected Kubernetes cluster.
This vulnerability is linked with another previously disclosed vulnerability, CVE-2023-3676, related to another command injection vulnerability. Both vulnerabilities were present on the Kubernetes cluster due to insecure function calls and a lack of user input sanitization.
Further analysis revealed that these command injections existed because of the lack of sanitization on the subPath parameter in YAML files, which uses the Kubelet service to execute commands with SYSTEM-level privileges.
This function makes a symlink between the location of the volume on the node and the location inside the pod. The exploitation involves the use of local volume type and persistent volume.
Once a persistentVolume is created, users can request for storage space using persistentVolumeClaim function.
It is worth denoting that Kubernetes uses YAML files for almost all of the functions inside the Kubernetes.
Hence, in this case, the local.path parameter inside a YAML file can be supplied with malicious commands executed during the mounting process
This vulnerability can be exploited on default installations of Kubernetes (earlier than version 1.28.4) and was tested against both on-prem deployments and Azure Kubernetes Service.
Kubernetes has acted swiftly upon this vulnerability and has deleted the cmd line function. They have replaced it with a native Go function that only performs the symlink operation.
This vulnerability affects the Kubernetes version earlier than 1.28.4. It is recommended that organizations upgrade their Kubernetes to the latest version to prevent the exploitation of this vulnerability.
