GitHub Advisoryadvisory · Go

GHSA-6pcv-qqx4-mxm3 Minikube RCE via DNS Rebinding

HIGH Published 2022-05-13 Modified 2023-07-21 Official page ↗
Aliases
CVE-2018-1002103
Ecosystem
Go
Packages
k8s.io/minikube
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2023-07-21

Affected packages

• Go k8s.io/minikube: >= 0.3.0, <= 0.29.0 (no fix yet)

Description

In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.

Related

Alias · CVE (1)

  • CVE-2018-1002103 In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References