Kubernetes RCE: Exploiting nodes/proxy GET

This is a minimal proof of concept. For a comprehensive analysis of this vulnerability, including root cause analysis, disclosure timeline, and detection recommendations, see the full blog post.

This lab demonstrates how nodes/proxy GET permissions allow command execution in any Pod, despite appearing to be read-only.

Enter the attacker pod​

First, exec into the attacker pod. This pod has a service account with only nodes/proxy GET permissions.

Код:

Check your permissions​

Verify the service account only has nodes/proxy GET:

Код:



You should see nodes/proxy with only the get verb - no create permission.

Set up environment variables​

Inside the attacker pod, set up the token and API server:

Код:


Extract the node name from the JWT token payload (JWT uses base64url encoding):

Код:

Discover Pods and Node IPs​

Using only nodes/proxy GET, query the API server proxy endpoint to list all pods on a node and discover their host IPs:

Код:


Extract just the node IP for later use:

Код:

Execute commands in any Pod​

Now use websocat to execute commands in the nginx pod. This works because WebSocket connections use HTTP GET for the handshake, bypassing the CREATE verb check:

Код:


You should see output like uid=0(root) gid=0(root) groups=0(root) - proving command execution with only GET permissions.

Код:



Read the contents of /etc/shadow on the nginx host.

Why does this work?​

For a full breakdown, please refer to the full disclosure.