CVE-2021-25740: Endpoint & EndpointSlice permissions allow cross-Namespace forwarding #103675

cjcullen · 2021-07-14T03:30:07Z

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.

This issue has been rated Low severity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), and assigned CVE-2021-25740.

Am I vulnerable?

If a potential attacker can create or edit Endpoints or EndpointSlices in the Kubernetes API, they can potentially direct a LoadBalancer or Ingress implementation to expose backend IPs the attacker should not have access to.
Importantly, if the target’s NetworkPolicy already trusts the Load Balancer or Ingress implementation, NetworkPolicy can not be used to prevent exposure from other namespaces, potentially bypassing any security controls such as LoadBalancerSourceRanges.
This issue is a design flaw that cannot be fully mitigated without user-facing changes. With this public announcement, we can begin conversations about a long-term fix.

Affected Versions

All Kubernetes versions are affected.

How do I mitigate this vulnerability?

There is no patch for this issue, and it can currently only be mitigated by restricting access to the vulnerable features. To mitigate the exposure, we recommend restricting write access to Endpoints and EndpointSlices by updating the system:aggregate-to-edit role using the attached file. This will remove write access to Endpoints from the admin and edit roles:

# Allow kubectl auth reconcile to work
kubectl annotate --overwrite clusterrole/system:aggregate-to-edit rbac.authorization.kubernetes.io/autoupdate=true

# Test reconcile, then run for real if happy
kubectl auth reconcile --remove-extra-permissions -f aggregate_to_edit_no_endpoints.yaml.txt --dry-run
kubectl auth reconcile --remove-extra-permissions -f aggregate_to_edit_no_endpoints.yaml.txt

# Prevent autoreconciliation back to old state
kubectl annotate --overwrite clusterrole/system:aggregate-to-edit rbac.authorization.kubernetes.io/autoupdate=false

Note: This will prevent new versions of Kubernetes from reconciling new default permissions to this role. No new default permissions have been added to this role since v1.14.0, but we recommend you remove the autoupdate=false annotation as soon as a fix or other mitigation is possible.

For use-cases that need to edit these resources, we recommend creating a new purpose-built Role with the desired permissions, and using it only for those cases.

Detection

Services with an empty selector rely on custom endpoints and are vulnerable to the attack described above. We recommend manually auditing any such usage. The following kubectl command will list all Services in a cluster with their selector:

kubectl get svc --all-namespaces -o=custom-columns='NAME:metadata.name,NAMESPACE:metadata.namespace,SELECTOR:spec.selector'

Note: Some Services without selectors specified may have their Endpoints managed by other controllers or tools. For example, endpoints for the default/kubernetes Service are managed by the Kubernetes API Server.

If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io

Additional Advisory

A similar attack is possible using Ingress implementations that support forwarding to ExternalName Services. This can be used to forward to Services in other namespaces or, in some cases, sensitive endpoints within the Ingress implementation. If you are using the Ingress API, we recommend confirming that the implementation you’re using either does not support forwarding to ExternalName Services or supports disabling the functionality.

Additional Details

See the GitHub issue for more updates: #103675

Thank You,
Rob Scott on behalf of Kubernetes SIG Network and CJ Cullen on behalf of the Kubernetes Product Security Committee

The text was updated successfully, but these errors were encountered:

robscott · 2021-07-15T05:27:48Z

The aggregate_to_edit.yaml file referenced above was attached to the original disclosure email: https://groups.google.com/g/kubernetes-announce/c/aXolwNe_KT4/m/HKK3174yAQAJ. I'm not sure if there's a good way to attach it here.

CVE-2021-25740 atack is possible to expose backend IPs to ExternalName Services kubernetes/kubernetes#103675

liggitt · 2021-07-15T16:01:08Z

appended .txt suffix and attached it to the description

… teeLoppback() fix: CVE-2021-25740 kubernetes/kubernetes#103675 allowed externalNames Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

rtheis · 2022-02-25T20:02:27Z

I'm sorry, I misunderstood that the system:aggregate-to-edit change can be undo before upgrade to 1.22 by running kubectl annotate --overwrite clusterrole/system:aggregate-to-edit rbac.authorization.kubernetes.io/autoupdate=true. This should give users the secure behavior and the 1.22 additions when the upgrade completes.

k8s-triage-robot · 2022-05-26T20:54:59Z

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

boindil · 2022-06-10T08:34:55Z

Hi,

could anyony explain whether or not this has been fixed (and in what version)? We are currently using GKE (v1.21.11 and v1.22.8)

k8s-triage-robot · 2022-07-10T08:53:59Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot · 2022-08-09T09:53:43Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Reopen this issue or PR with /reopen
Mark this issue or PR as fresh with /remove-lifecycle rotten
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

k8s-ci-robot · 2022-08-09T09:53:59Z

@k8s-triage-robot: Closing this issue.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied

After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied

After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Reopen this issue or PR with /reopen

Mark this issue or PR as fresh with /remove-lifecycle rotten

Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

cjcullen · 2022-08-09T18:59:44Z

Getting closed out by the triage bot is a kinda unceremonious death, but this issue should have been closed a while back with the work done to remove Endpoint & EndpointSlice permissions from the default roles, and docs changes to highlight the risk.

JohnJAS · 2022-10-14T02:17:45Z

Although this issue was closed, please notice that the Endpoint & EndpointSlice permission won't be deleted automactically if upgrading K8s from an impacted version.

Here are some tips for this situation. Please correct me if anything wrong.

I suggest to remove the Endpoint & EndpointSlice permission only instead of directly using the yaml above because it will delete more permissions on the new K8s version. And it is better to set rbac.authorization.kubernetes.io/autoupdate to true becasue new K8s version won't add the endpoints&endpointslices back to the clusterrole.

Commands for reference:

# Set rbac.authorization.kubernetes.io/autoupdate to true and keep it
kubectl annotate --overwrite clusterrole/system:aggregate-to-edit rbac.authorization.kubernetes.io/autoupdate=true

# Remove Endpoint & EndpointSlice permission only
kubectl get clusterroles system:aggregate-to-edit -o yaml > /tmp/aggregate_to_edit_no_endpoints.yaml
sed -i '/endpoints/d' /tmp/aggregate_to_edit_no_endpoints.yaml
sed -i '/endpointslices/d' /tmp/aggregate_to_edit_no_endpoints.yaml
kubectl auth reconcile --remove-extra-permissions -f /tmp/aggregate_to_edit_no_endpoints.yaml

RyanStan · 2022-11-08T18:20:44Z

Is this is the pr (103703) that fixed this? Looks like this went into 1.22.0

robscott · 2022-11-08T19:29:20Z

@RyanStan this is the most relevant PR (also merged to 1.22): #103704. The other PR reverts a change that was merged in the 1.22 release cycle but reverted. As the issue above states, that patch is only effective for new 1.22+ clusters, others will want to run the manual mitigation steps described above.

antoinetran · 2024-01-22T16:27:48Z

Hi, when using vcluster, this RBAC is needed (see loft-sh/vcluster#1465). We cannot deploy vcluster, which is a really useful tool to deploy components that needs cluster-wide privilege for CRDs, in an shared environment Kubernetes.

I am thinking of alternative on how to mitigate this CVE while find a way to deploy vcluster.Since Ingresses are a bit deprecated in favor of Gateway API (which is now GA and integrated in OpenShift). Does this CVE impacts Gateway API? Maybe if we disable Ingresses and only enable Gateway in our shared Kubernetes, if that CVE is not relevant in this configuration, then our admin could give Endpoints privilege again...

cjcullen added the kind/bug label Jul 14, 2021

k8s-ci-robot added needs-sig needs-triage labels Jul 14, 2021

cjcullen removed kind/bug needs-sig needs-triage labels Jul 14, 2021

kubernetes deleted a comment from k8s-ci-robot Jul 14, 2021

cjcullen changed the title ~~WIP~~ CVE-2021-25740: Endpoint & EndpointSlice permissions allow cross-Namespace forwarding Jul 14, 2021

robscott mentioned this issue Jul 14, 2021

Support for services of type "ExternalName" kubernetes/ingress-gce#1169

Closed

rikatz mentioned this issue Jul 14, 2021

Add configuration to disable external name service feature kubernetes/ingress-nginx#7314

Merged

8 tasks

This was referenced Jul 14, 2021

Revert granting EndpointSlice write access to edit role #103703

Merged

Remove Endpoints write access from aggregated edit role #103704

Merged

Adding GEP-709: Cross namespace references from Routes kubernetes-sigs/gateway-api#711

Merged

longwuyuan mentioned this issue Jul 15, 2021

New ExternalName services aren't detected consistently kubernetes/ingress-nginx#7346

Closed

harkirat22 mentioned this issue Jul 15, 2021

K8s Policy to detect a service type Loadbalancer without a selector tenable/terrascan#931

Merged

prometherion mentioned this issue Jul 16, 2021

Block usage of ExternalName Service type projectcapsule/capsule#339

Closed

This was referenced Jul 20, 2021

Adding documentation about Endpoints write access in wake of CVE-2021-25740 kubernetes/website#29025

Merged

New task page for CVE-2021-25740 mitigation kubernetes/website#29044

Closed

miwithro mentioned this issue Jul 22, 2021

CVE-2021-25740: Endpoint & EndpointSlice permissions allow cross-Namespace forwarding Azure/AKS#2455

Closed

ldez mentioned this issue Jul 23, 2021

Disable ExternalName Services by default on Kubernetes providers traefik/traefik#8261

Merged

2 tasks

youngnick mentioned this issue Jul 28, 2021

Gatekeeper config for ExternalName Service hostname allowlist projectcontour/contour#3925

Closed

szuecs mentioned this issue Jul 28, 2021

fix: skipper goroutine leak with special filter config zalando-incubator/kubernetes-on-aws#4500

Merged

youngnick mentioned this issue Aug 16, 2021

Alternatives approaches to supporting ExternalName services projectcontour/contour#3950

Closed

fseldow mentioned this issue Aug 17, 2021

ClusterRole system:aggregate-to-edit should not allow endpoints permissions open-policy-agent/gatekeeper-library#101

Merged

matskiv mentioned this issue Jan 7, 2022

Stop synchronizing Endpoints that belong to a Service and enhance Service sync to preserve functionality loft-sh/vcluster#281

Closed

tallclair mentioned this issue Mar 9, 2022

KEP-3203: Add Auto-refreshing Official CVE feed kubernetes/enhancements#3204

Merged

robscott mentioned this issue Mar 24, 2022

Explicitly define ExternalName expectations kubernetes-sigs/gateway-api#1070

Closed

k8s-ci-robot added the lifecycle/stale label May 26, 2022

Shubham82 mentioned this issue May 27, 2022

Reconciler for clusterrole not reconciling properly #110238

Closed

k8s-ci-robot added lifecycle/rotten and removed lifecycle/stale labels Jul 10, 2022

k8s-ci-robot closed this as completed Aug 9, 2022

dprotaso mentioned this issue Feb 22, 2023

no defined semantics for EndpointSlices of type "FQDN" #114210

Closed

harridu mentioned this issue Feb 26, 2023

[BUG] Project Owner is forbidden to create endpoints rancher/rancher#40677

Closed

youngnick mentioned this issue Mar 23, 2023

Specifying ExternalName Service in HTTPRoute does not work as intended cilium/cilium#24495

Closed

2 tasks

antoinetran mentioned this issue Jan 22, 2024

RBAC endpoints for "create" "delete" "patch" "update" forbidden loft-sh/vcluster#1465

Closed

OlleLarsson mentioned this issue Feb 8, 2024

Update page for in-cluster network communication elastisys/welkin#786

Open

redbaron mentioned this issue Feb 11, 2024

EndpointSlices causes crash (panic) with headless service kubernetes/ingress-nginx#9606

Closed

JoeyC-Dev referenced this issue in MicrosoftDocs/azure-docs May 7, 2024

Update app-routing-nginx-configuration.md

aa05d9f

aojea mentioned this issue Jul 24, 2024

KEP 4770: EndpointSlice Controller Flexibility kubernetes/enhancements#4771

Open

kassah mentioned this issue Jul 25, 2024

Feature: RBAC Add view, edit and admin roles for BackendConfig kubernetes/ingress-gce#2608

Open

raesene mentioned this issue Mar 7, 2025

Some Kubernetes CVEs don't appear on the official feed kubernetes/sig-security#135

Open

landerss1 mentioned this issue Apr 16, 2025

CVE-2021-25740 XenitAB/terraform-modules#358

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CVE-2021-25740: Endpoint & EndpointSlice permissions allow cross-Namespace forwarding #103675

CVE-2021-25740: Endpoint & EndpointSlice permissions allow cross-Namespace forwarding #103675

cjcullen commented Jul 14, 2021 •

edited

Loading

robscott commented Jul 15, 2021 •

edited

Loading

liggitt commented Jul 15, 2021

rtheis commented Feb 25, 2022 •

edited

Loading

k8s-triage-robot commented May 26, 2022

boindil commented Jun 10, 2022

k8s-triage-robot commented Jul 10, 2022

k8s-triage-robot commented Aug 9, 2022

k8s-ci-robot commented Aug 9, 2022

cjcullen commented Aug 9, 2022

JohnJAS commented Oct 14, 2022

RyanStan commented Nov 8, 2022

robscott commented Nov 8, 2022

antoinetran commented Jan 22, 2024

CVE-2021-25740: Endpoint & EndpointSlice permissions allow cross-Namespace forwarding #103675

CVE-2021-25740: Endpoint & EndpointSlice permissions allow cross-Namespace forwarding #103675

Comments

cjcullen commented Jul 14, 2021 • edited Loading

Am I vulnerable?

Affected Versions

How do I mitigate this vulnerability?

Detection

Additional Advisory

Additional Details

robscott commented Jul 15, 2021 • edited Loading

liggitt commented Jul 15, 2021

rtheis commented Feb 25, 2022 • edited Loading

k8s-triage-robot commented May 26, 2022

boindil commented Jun 10, 2022

k8s-triage-robot commented Jul 10, 2022

k8s-triage-robot commented Aug 9, 2022

k8s-ci-robot commented Aug 9, 2022

cjcullen commented Aug 9, 2022

JohnJAS commented Oct 14, 2022

RyanStan commented Nov 8, 2022

robscott commented Nov 8, 2022

antoinetran commented Jan 22, 2024

cjcullen commented Jul 14, 2021 •

edited

Loading

robscott commented Jul 15, 2021 •

edited

Loading

rtheis commented Feb 25, 2022 •

edited

Loading