CVE-2018-1002103

In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.

CVSS v3 8.8 HIGH
CVSS v2.0 6.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/kubernetes/minikube/issues/3208	Mitigation Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:kubernetes:minikube:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-12-05 21:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-1002103

Mitre link : CVE-2018-1002103

CVE.ORG link : CVE-2018-1002103

JSON object : View

Products Affected

kubernetes

minikube

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2018-1002103", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "jordan@liggitt.net", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2018-12-05T21:29:00.357", "references": [{"url": "https://github.com/kubernetes/minikube/issues/3208", "tags": ["Mitigation", "Issue Tracking", "Third Party Advisory"], "source": "jordan@liggitt.net"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem."}, {"lang": "es", "value": "En Minikube 0.3.0-0.29.0, minikube expone el Dashboard de Kubernetes escuchando en la IP VM en el puerto 30000. En los entornos VM en los que la IP es f\u00e1cil de predecir, el atacante puede emplear el reenlace de DNS para realizar peticiones de forma indirecta al Dashboard de Kubernetes y crear una nueva implementaci\u00f3n de Kubernetes que ejecute c\u00f3digo arbitrario. Si se emplea el punto de montaje de minikube, el atacante tambi\u00e9n podr\u00eda obtener acceso directamente al sistema de archivos del host."}], "lastModified": "2019-10-09T23:32:34.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kubernetes:minikube:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "683D36B2-E055-49DB-B07E-6D2EF5A287F1", "versionEndIncluding": "0.29.0", "versionStartIncluding": "0.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "jordan@liggitt.net"}