Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.
CVSS Rating: [CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N/E:F (Low)](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N/E:F)

An attacker-controlled Kubelet can return an arbitrary redirect when responding to certain apiserver requests. Impacted kube-apiservers will follow the redirect as a GET request with client-cert credentials for authenticating to the Kubelet.

### Am I vulnerable?

Kubernetes API servers with the `StreamingProxyRedirects` [feature](https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/) enabled AND without the `ValidateProxyRedirects` feature are affected.

API servers using SSH tunnels (--ssh-user / --ssh-keyfile) are not affected.

Using the default feature gate values, kube-apiserver versions before v1.14 are affected.

### How do I mitigate this vulnerability?

For Kubernetes versions >= v1.10.0, the `ValidateProxyRedirects` can be manually enabled with the `kube-apiserver` flag `--feature-gates=ValidateProxyRedirects=true`.

#### Fix impact
The `ValidateProxyRedirects` feature will cause the kube-apiserver to check that redirects go to the same host. If nodes are configured to respond to CRI streaming requests on a different host interface than what the apiserver makes requests on (only the case if not using the built-in dockershim & setting the kubelet flag `--redirect-container-streaming=true`), then these requests will be broken. In that case, the feature can be temporarily disabled until the node configuration is corrected. We suggest setting `--redirect-container-streaming=false` on the kubelet to avoid issues.

#### Fixed Versions

- Kubernetes v1.14+ - Fixed by default in https://github.com/kubernetes/kubernetes/pull/72552
- Kubernetes v1.10-v1.14 - Fix available as alpha in https://github.com/kubernetes/kubernetes/pull/66516

## Additional Details

In a future release, we plan to deprecate the `StreamingProxyRedirects` feature, instead opting to handle the redirection locally through the Kubelet. Once the deprecation is complete, we can completely remove apiserver redirect handling (at least for Kubelet requests).

#### Acknowledgements

This vulnerability was reported by Alban Crequy.

/area security
/kind bug
/committee product-security
/sig api-machinery node
/area apiserver

/close
CVE-2018-1002102: Unvalidated redirect
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2018-1002102: Unvalidated redirect
Issue date:

--- start body ---
CVSS Rating: [CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N/E:F (Low)](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N/E:F)

An attacker-controlled Kubelet can return an arbitrary redirect when responding to certain apiserver requests. Impacted kube-apiservers will follow the redirect as a GET request with client-cert credentials for authenticating to the Kubelet.

### Am I vulnerable?

Kubernetes API servers with the `StreamingProxyRedirects` [feature](https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/) enabled AND without the `ValidateProxyRedirects` feature are affected.

API servers using SSH tunnels (--ssh-user / --ssh-keyfile) are not affected.

Using the default feature gate values, kube-apiserver versions before v1.14 are affected.

### How do I mitigate this vulnerability?

For Kubernetes versions >= v1.10.0, the `ValidateProxyRedirects` can be manually enabled with the `kube-apiserver` flag `--feature-gates=ValidateProxyRedirects=true`.

#### Fix impact
The `ValidateProxyRedirects` feature will cause the kube-apiserver to check that redirects go to the same host. If nodes are configured to respond to CRI streaming requests on a different host interface than what the apiserver makes requests on (only the case if not using the built-in dockershim & setting the kubelet flag `--redirect-container-streaming=true`), then these requests will be broken. In that case, the feature can be temporarily disabled until the node configuration is corrected. We suggest setting `--redirect-container-streaming=false` on the kubelet to avoid issues.

#### Fixed Versions

- Kubernetes v1.14+ - Fixed by default in https://github.com/kubernetes/kubernetes/pull/72552
- Kubernetes v1.10-v1.14 - Fix available as alpha in https://github.com/kubernetes/kubernetes/pull/66516

## Additional Details

In a future release, we plan to deprecate the `StreamingProxyRedirects` feature, instead opting to handle the redirection locally through the Kubelet. Once the deprecation is complete, we can completely remove apiserver redirect handling (at least for Kubelet requests).

#### Acknowledgements

This vulnerability was reported by Alban Crequy.

/area security
/kind bug
/committee product-security
/sig api-machinery node
/area apiserver

/close
--- end body ---
