A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

This issue has been rated **Medium** (https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) (4.1), and assigned **CVE-2020-8561**

### Am I vulnerable?

You may be vulnerable if `--profiling` is enabled on the kube-apiserver and actors who control a validating or mutating webhook can access the kube-apiserver process logs.

#### Affected Versions

This issue affects all known versions of kube-apiserver. 

### How do I mitigate this vulnerability?

This issue can be mitigated by not allowing kube-apiserver access to sensitive resources or networks, or to reduce the “-v” flag value to less than 10 and set the “--profiling” flag value to “false” (default value is “true”). Setting the profiling flag to “false” prevents users from dynamically modifying the kube-apiserver log level, and the flag value Webhook requests may still be redirected to private networks with a log level less than 10, but the response body will not be logged.

### Fixed Versions
There is no fix for this issue at this time.

### Detection

Examining kube-apiserver log responses is the only known method of detection for this issue.

If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io

#### Acknowledgements

This vulnerability was reported by QiQi Xu


/triage accepted
/lifecycle frozen
/area security
/kind bug
/committee security-response
CVE-2020-8561: Webhook redirect in kube-apiserver
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2020-8561: Webhook redirect in kube-apiserver
Issue date:

--- start body ---
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

This issue has been rated **Medium** (https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) (4.1), and assigned **CVE-2020-8561**

### Am I vulnerable?

You may be vulnerable if `--profiling` is enabled on the kube-apiserver and actors who control a validating or mutating webhook can access the kube-apiserver process logs.

#### Affected Versions

This issue affects all known versions of kube-apiserver. 

### How do I mitigate this vulnerability?

This issue can be mitigated by not allowing kube-apiserver access to sensitive resources or networks, or to reduce the “-v” flag value to less than 10 and set the “--profiling” flag value to “false” (default value is “true”). Setting the profiling flag to “false” prevents users from dynamically modifying the kube-apiserver log level, and the flag value Webhook requests may still be redirected to private networks with a log level less than 10, but the response body will not be logged.

### Fixed Versions
There is no fix for this issue at this time.

### Detection

Examining kube-apiserver log responses is the only known method of detection for this issue.

If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io

#### Acknowledgements

This vulnerability was reported by QiQi Xu


/triage accepted
/lifecycle frozen
/area security
/kind bug
/committee security-response
--- end body ---
