Crafty Requests: Deep Dive Into Kubernetes CVE-2018-1002105
summary
CVE-2018-1002105 allows specially crafted connection upgrade WebSocket requests to bypass the API server and speak directly to backends, enabling both namespace-limited privilege escalation (pod exec/port-forward) and unauthenticated RCE via extension API server discovery; the worst path scores 9.8 CVSS. Public PoCs in Go, Python, Ruby etc. actively exfiltrate secrets and metadata; the upstream remedy is a 37-line fix that validates upgrades. Immediate patching and defense-in-depth (reduce aggregated APIs, tighten discovery, watch supply chain) are the practical mitigations.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:06CVE discovery
- 3:59CVE-2018-1002105 details
- 8:56Kubernetes API server
- 11:50WebSocket flaw
- 15:27Attack vectors
- 18:38Default access risks
- 20:05Exploit demo
- 23:22How the vulnerability was fixed
- 24:48Update recommendations
- 26:10Defense in depth
- 30:05Security improvements
- 32:16Community takeaways
- 32:59Resources
related talks
27mWhat Doesn’t Kill You Makes You Stronger: The Vulnerabilities Th...
38mKubernetes Security: Attacking and Defending K8s Clusters
38mKubernetes Security: Attacking and Defending K8s Clusters
49mAttacking and Detecting Attacks on Kubernetes Clusters
33mTutorial: Hack My Mis-Configured Kubernetes
46mThe Hacker's Guide to Kubernetes
29mKubernetes Security: Attacking and Defending K8s Clusters
31mA Hacker's Guide to Kubernetes and the Cloud