Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Internal KUBERNETES_SERVICE_HOST IP address disclosure in /config endpoint #184

Closed
zmotso opened this issue Apr 8, 2024 · 1 comment
Closed
Assignees
Labels
enhancement New feature or request

Comments

@zmotso
Copy link
Contributor

zmotso commented Apr 8, 2024

Affected endpoint:
GET /config
Details:
While the delivery platform is running, the application periodically sends configuration requests (GET /config) and health checks (GET /clusters/main/healthz). While sending a GET /config request application reveals the KUBERNETES_SERVICE_HOST's internal IP address in the responses, intended for internal use within the cluster and backend systems. This exposure could allow attackers, in the event of a compromised pod, to target the system (for example, with DOS/DDOS attacks) or to learn the internal IP addressing schema.

@zmotso zmotso added the enhancement New feature or request label Apr 8, 2024
@zmotso zmotso self-assigned this Apr 8, 2024
epmd-edp pushed a commit that referenced this issue Apr 8, 2024
Change-Id: Iaa3cdd74cc8fa4302f6b5e6b0e40ede3e4e1efcb
@zmotso zmotso moved this to In Progress in KubeRocketCI Apr 9, 2024
@zmotso
Copy link
Contributor Author

zmotso commented Apr 9, 2024

Done.

@zmotso zmotso closed this as completed Apr 9, 2024
@github-project-automation github-project-automation bot moved this from In Progress to Done in KubeRocketCI Apr 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
Archived in project
Development

No branches or pull requests

1 participant