PT-2018-2000 · Kubernetes · Minikube

Alex Kaskasoli · Published 2018-12-03 · Updated 2024-08-20 · CVE-2018-1002103

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions minikube versions 0.3.0 through 0.29.0

Description The issue is related to privilege management errors in the minikube command-line utility. It allows a remote attacker to execute arbitrary code. In certain VM environments where the IP is easy to predict, an attacker can use DNS rebinding to make indirect requests to the Kubernetes Dashboard, creating a new Kubernetes Deployment that runs arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.

Recommendations For minikube versions 0.3.0 through 0.29.0, consider disabling the Kubernetes Dashboard or restricting access to it until a patch is available. As a temporary workaround, avoid using minikube mount to prevent direct access to the host filesystem. Restrict access to the VM IP at port 30000 to minimize the risk of DNS rebinding attacks.

Fix

Improper Privilege Management

CSRF

Weakness Enumeration

CWE-269

CWE-352

Related Identifiers

BDU:2018-01616

CVE-2018-1002103

GHSA-6PCV-QQX4-MXM3

GO-2023-1961

OPENSUSE-SU-2024:11051-1

Affected Products

Minikube

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2018-1002103 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1002103 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1961 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01616 · Security Note
• https://osv.dev/vulnerability/GHSA-6pcv-qqx4-mxm3 · Vendor Advisory
• https://github.com/kubernetes/minikube/issues/3208 · Note
• https://github.com/kubernetes/minikube/issues/3208; · Note
• https://github.com/advisories/GHSA-6pcv-qqx4-mxm3 · Note
• https://labs.mwrinfosecurity.com/advisories/minikube-rce · Note