Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-3294

CVE-2022-3294: Kubernetes vulnerable to validation bypass

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-3294
GHSA ID
GHSA-jh36-q97c-9928
EPSS Score
0.63648%
CWE
CWE-20
Published
3/1/2023
Updated
5/5/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/kubernetes/kubernetesgo>= 1.25.0, < 1.25.41.25.4
github.com/kubernetes/kubernetesgo>= 1.22.0, < 1.22.161.22.16
github.com/kubernetes/kubernetesgo>= 1.24.0, < 1.24.81.24.8
github.com/kubernetes/kubernetesgo>= 1.23.0, < 1.23.141.23.14

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper validation in node proxying logic. The ProxyREST.Connect function is responsible for handling node proxy requests and validating target addresses. The vulnerability allowed bypassing network restrictions by accepting unvalidated address types (like InternalIP instead of ExternalIP) or localhost addresses. This matches the CWE-20 (Improper Input Validation) classification and aligns with the described attack vector where modified Node objects could route requests to API server's private network.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Us*rs m*y **v* ****ss to s**ur* *n*points in t** *ontrol pl*n* n*twork. Ku**rn*t*s *lust*rs *r* only *****t** i* *n untrust** us*r **n mo*i*y No** o*j**ts *n* s*n* proxy r*qu*sts to t**m. Ku**rn*t*s supports no** proxyin*, w*i** *llows *li*nts o* ku*

Reasoning

T** vuln*r**ility st*ms *rom improp*r `v*li**tion` in no** proxyin* lo*i*. T** `ProxyR*ST.*onn**t` *un*tion is r*sponsi*l* *or **n*lin* no** proxy r*qu*sts *n* v*li**tin* t*r**t ***r*ss*s. T** vuln*r**ility *llow** *yp*ssin* n*twork r*stri*tions *y *