CVE-2020-8559 PoC — Privilege escalation from compromised node to cluster

Source

https://github.com/tabbysable/POC-2020-8559

Associated Vulnerability

Title:Privilege escalation from compromised node to cluster (CVE-2020-8559)
Description:The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

Description

Proof of Concept exploit for Kubernetes CVE-2020-8559

Readme

# POC-2020-8559

Exploit for CVE-2020-8559. We steal all the connections to the kubelet using iptables then rewrite the 101 or 302 responses to 307. The 101s are for modern Kubernetes versions, the 302s are for older ones.

We don't have access to the kube-apiserver's x509 cert, so kubelet webhook auth can be a problem. No problem with this kubelet config fragment, which basically re-enables the old-time kubelet-exploit:

```
authentication:
  anonymous:
    enabled: true
authorization:
  mode: AlwaysAllow
```

File Snapshot


 [4.0K]  /data/pocs/3deb284df08027d41d355a40c142fdf8cc58f44f
├── [1.2K]  LICENSE.txt
├── [6.9K]  poc-2020-8559.sh
└── [ 516]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!