In plain words
Imagine you have a shared folder on a network, and you want to access it from your computer. Normally, you would need to enter a password to access the folder. But in this case, there is a bug that allows an attacker to trick the system into giving them access to the folder without needing a password. This is similar to someone leaving a door unlocked, and an attacker finding the unlocked door and getting in.
What's broken
The bug is in Kubernetes¹, a system that helps manage computer applications, and it affects Windows nodes², which are computers that run the Windows operating system. The bug is called a subpath symlinking vulnerability, and it allows an attacker to create a symbolic link³ that points to a network share⁴ that they control. When the Kubernetes system tries to access the link, it does not check if the link is safe, and it will try to authenticate⁵ to the network share using NTLM⁶, which is a protocol⁷ used for authentication. This allows the attacker to get the NetNTLMv2⁸ hash, which can be used to access the system.
How it actually works
Here's how it works: when a pod⁹, which is a group of applications, is mounted to a volume¹⁰, the Kubernetes system will try to resolve any symbolic links in the path. If the link points to a UNC path¹¹, which is a type of network path, the system will try to authenticate to the path using NTLM. The attacker can control the network share, so they can make the system authenticate in a way that gives them the NetNTLMv2 hash. This is like a chain of events, where the attacker creates a link, the system tries to access the link, and then the system gives the attacker the information they need.
Proof of concept
There is a proof of concept¹², which is a demonstration of the bug, but it is not clear from the source if it is a public exploit or just a demonstration by a researcher. A proof of concept shows that the bug is real and can be exploited, which makes it more urgent to fix. It proves that the flaw is not just theoretical, but can actually be used by an attacker.
Is it real
It is not clear from the source if this bug is being actively exploited in the wild. However, the fact that it exists and can be exploited makes it a significant issue. The bug can be mitigated by patching the Kubernetes system or by turning off the feature that allows subpath symlinking.
What to do
To fix this bug, you should patch the Kubernetes system or turn off the feature that allows subpath symlinking. This will prevent an attacker from exploiting the bug and getting the NetNTLMv2 hash.
Terms
- ¹ Kubernetes
- , a system that helps manage computer applications
- ² Windows nodes
- , computers that run the Windows operating system
- ³ symbolic link
- , a type of link that points to another location
- ⁴ network share
- , a shared folder on a network
- ⁵ authenticate
- , the process of verifying the identity of a user or system
- ⁶ NTLM
- , a protocol used for authentication
- ⁷ protocol
- , a set of rules that govern how data is communicated
- ⁸ NetNTLMv2
- , a type of hash that can be used to access a system
- ⁹ pod
- , a group of applications