Kubernetes and the Challenge of a Huge Security Vulnerability CVE-2018-1002105

If you run a Kubernetes cluster, you probably heard the news this week about CVE-2018-1002105. This is a privilege escalation issue within Kubernetes that essentially allowed one to send commands to a Kubernetes cluster and administer the cluster without appropriate permissions.

We are going to explain the vulnerability in very simplistic terms since many of our readers are still new to Kubernetes. At its essence, Kubernetes has an API server that allows one to send queries and requests to the backend servers. With CVE-2018-1002105, one could craft requests to the Kubernetes API server that would allow one to send commands from the API server to the backend servers, validated by the API server credentials. Using this method, and depending upon your API server configuration, one was able to send commands to turn off or start services on the back end server as if it was the API server requesting the action from an authenticated and valid API request. Essentially, this is like a root level vulnerability for an entire Kubernetes cluster.

The concern with the vulnerability is that they show as properly authorized actions in logs. On most clusters, it will be nearly impossible to distinguish a legitimate API call versus one exploiting the CVE-2018-1002105 vulnerability. Looking like a normal entry in a log will not trigger alarms in monitoring software, and can make forensic investigation difficult to see if this privilege escalation vulnerability was used.