5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-9042

CVE-2024-9042: Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API

A security vulnerability has been discovered in Kubernetes windows nodes that could allow a user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host. This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-9042

CVE-2024-9042:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
k8s.io/kubernetes	go	< 1.29.13	1.29.13
k8s.io/kubernetes	go	>= 1.30.0-alpha.0, < 1.30.9	1.30.9
k8s.io/kubernetes	go	>= 1.31.0-alpha.0, < 1.31.5	1.31.5
k8s.io/kubernetes	go	>= 1.32.0-alpha.0, < 1.32.1	1.32.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a command injection in the Kubernetes kubelet on Windows nodes, occurring when querying the /logs endpoint. The provided patches show that the getLoggingCmd function in pkg/kubelet/kubelet_server_journal_windows.go was modified to no longer directly embed user-controlled parameters (like log query filters, time ranges, service names) into a PowerShell command string. Instead, the patched version uses environment variables to pass these parameters, which is a standard mitigation for command injection. The vulnerable version of getLoggingCmd constructed the command string by concatenating these parameters, making it susceptible to injection. The copyServiceLogs function in pkg/kubelet/kubelet_server_journal.go is responsible for calling getLoggingCmd and then executing the generated command. Therefore, both functions are critical to the vulnerability: getLoggingCmd for constructing the malicious command and copyServiceLogs for executing it. Both would appear in a runtime profile during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.