Kubesphere
Monthly
KubeSphere 4.1.3 and earlier ship a git credential verification endpoint that fetches caller-supplied URLs without any allowlist validation, letting an authenticated user point the server at internal services and capture the basic-auth credentials returned in the endpoint's error handling. The flaw is a classic CWE-918 SSRF that escalates into cross-namespace Secret disclosure because the leaked responses can expose credentials stored in any namespace. No public exploit code or CISA KEV entry has been identified at time of analysis, but the source-level references confirm the vulnerable code paths, and the CVSS 4.0 score of 8.3 reflects high confidentiality impact on both the vulnerable component and subsequent systems.
Server-Side Request Forgery in KubeSphere's multi-cluster controller allows any low-privileged user with Cluster CRD create or update permissions to weaponize the controller-manager and apiserver pods as HTTP proxies against arbitrary internal addresses, RFC1918 networks, and cloud instance metadata services including AWS IMDS at 169.254.169.254. The flaw resides in `pkg/utils/clusterclient/clusterclient.go` (addCluster), where the CRD-specified Kubernetes API endpoint undergoes only Go `url.Parse()` syntax validation before `Discovery().ServerVersion()` is called - no loopback, private-range, link-local, or metadata-address filtering is applied. A public researcher write-up demonstrating the attack path exists; no active exploitation has been confirmed in CISA KEV at time of analysis.
KubeSphere 4.1.3 and earlier ship a git credential verification endpoint that fetches caller-supplied URLs without any allowlist validation, letting an authenticated user point the server at internal services and capture the basic-auth credentials returned in the endpoint's error handling. The flaw is a classic CWE-918 SSRF that escalates into cross-namespace Secret disclosure because the leaked responses can expose credentials stored in any namespace. No public exploit code or CISA KEV entry has been identified at time of analysis, but the source-level references confirm the vulnerable code paths, and the CVSS 4.0 score of 8.3 reflects high confidentiality impact on both the vulnerable component and subsequent systems.
Server-Side Request Forgery in KubeSphere's multi-cluster controller allows any low-privileged user with Cluster CRD create or update permissions to weaponize the controller-manager and apiserver pods as HTTP proxies against arbitrary internal addresses, RFC1918 networks, and cloud instance metadata services including AWS IMDS at 169.254.169.254. The flaw resides in `pkg/utils/clusterclient/clusterclient.go` (addCluster), where the CRD-specified Kubernetes API endpoint undergoes only Go `url.Parse()` syntax validation before `Discovery().ServerVersion()` is called - no loopback, private-range, link-local, or metadata-address filtering is applied. A public researcher write-up demonstrating the attack path exists; no active exploitation has been confirmed in CISA KEV at time of analysis.