PT-2025-1258 · Unknown+2 · Kubernetes+1

Aravindh Puthiyaprambil + 3 · Published 2025-01-15 · Updated 2025-12-11 · CVE-2024-9042

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Kubernetes versions prior to 1.29.14 Kubernetes versions prior to 1.30.10 Kubernetes versions prior to 1.31.6

Description This issue is a command injection affecting Windows worker nodes via the /logs query API. The vulnerability allows attackers to execute arbitrary commands on the host machine. The pattern parameter of the NodeLogQuery feature is directly passed to PowerShell without filtering, enabling command injection for any user or service account with GET permissions on nodes/logs. Successful exploitation allows execution of commands with SYSTEM privileges on all Windows nodes.

Recommendations Upgrade Kubernetes to version 1.29.14 or later. Upgrade Kubernetes to version 1.30.10 or later. Upgrade Kubernetes to version 1.31.6 or later.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-20

CWE-77

Related Identifiers

ALT-PU-2025-4533

ALT-PU-2025-4535

ALT-PU-2025-4536

BDU:2025-00672

CVE-2024-9042

ECHO-0DED-644A-1F25

GHSA-VV39-3W5Q-974Q

GO-2025-3522

OPENSUSE-SU-2025:14937-1

Affected Products

Alt Linux

Kubernetes

References · 89

• https://osv.dev/vulnerability/GHSA-vv39-3w5q-974q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-9042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9042 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:14937-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00672 · Security Note
• https://osv.dev/vulnerability/GO-2025-3522 · Vendor Advisory
• https://github.com/kubernetes/kubernetes · Note
• https://github.com/kubernetes/kubernetes/issues/129654 · Note
• https://github.com/kubernetes/kubernetes/commit/fb0187c2bf7061258bb89891edb1237261eb7abc · Note
• https://github.com/kubernetes/kubernetes/commit/75c83a6871dc030675288c6d63c275a43c2f0d55 · Note
• https://github.com/kubernetes/kubernetes/commit/45f4ccc2153bbb782253704cbe24c05e22b5d60c · Note
• https://github.com/kubernetes/kubernetes/commit/5fe148234f8ab1184f26069c4f7bef6c37efe347 · Note
• https://twitter.com/the_yellow_fall/status/1879712446887428526 · Twitter Post
• https://t.me/teamdarkarmy/2799 · Note
• https://reddit.com/r/SecOpsDaily/comments/1pj6bti/possible_exploit_variant_for_cve20249042 · Reddit Post