Improper Input Validation Affecting github.com/kubernetes/kubernetes/pkg/volume/git_repo package, versions *

Affected versions of this package are vulnerable to Improper Input Validation. An attacker with create pod permission could access local git repositories belonging to other pods on the same node by exploiting this vulnerability.

Notes:

1. This is only exploitable if the cluster still uses the deprecated in-tree gitRepo volume feature to clone git repositories from other pods within the same node;

2. The in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream;

3. To detect whether this vulnerability has been exploited, the following command can be used to list all pods that use the in-tree gitRepo volume and clone to a .git subdirectory:

`kubectl get pods --all-namespaces -o json | jq '.items[] | select(.spec.volumes[].gitRepo.repository | test("^/")) | {name: .metadata.name, namespace: .metadata.namespace, repository: (.spec.volumes[] | select(.gitRepo) | .gitRepo.repository)}'`

This can be mitigated by using an init container to perform git clone operation and then mount the directory into the Pod's container. An example of this approach is provided here.

The use of gitRepo volumes can be restricted in the cluster using policies such as ValidatingAdmissionPolicy or through Restricted pod security standard policy. The following Common Expression Language (CEL) expression can be used as part of a policy to reject use of gitRepo volumes: has(object.spec.volumes) || !object.spec.volumes.exists(v, has(v.gitRepo))

• GitHub PR
• Google Groups Forum