Description
In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Kubernetes | Minikube | affected |
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-2835 | In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem. |
 Github GHSA |
GHSA-6pcv-qqx4-mxm3 | Minikube RCE via DNS Rebinding |
References
| Link | Providers |
|---|---|
| https://github.com/kubernetes/minikube/issues/3208 |
|
History
No history.
MITRE
Status: PUBLISHED
Assigner: kubernetes
Published:
Updated: 2024-09-16T22:35:01.118Z
Reserved: 2018-12-05T00:00:00.000Z
Link: CVE-2018-1002103
Vulnrichment
No data.
NVD
Status : Modified
Published: 2018-12-05T21:29:00.357
Modified: 2024-11-21T03:40:38.700
Link: CVE-2018-1002103
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses