CVE-2022-3172 (GCVE-0-2022-3172)

Vulnerability from cvelistv5 – Published: 2023-11-03 18:11 – Updated: 2025-02-13 16:32
VLAI
Title
Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)
Summary
A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.
Severity
5.1 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
Vendor Product Version
Kubernetes kube-apiserver Affected: v1.25.0
Affected: v1.24.0 , ≤ v1.24.4 (semver)
Affected: v1.23.0 , ≤ v1.23.10 (semver)
Affected: v1.22.0 , ≤ v1.22.13 (semver)
Unaffected: v1.25.1
Unaffected: v1.24.5
Unaffected: v1.23.11
Unaffected: v1.22.14
Affected: 0 , ≤ v1.21.14 (semver)
Create a notification for this product.
Date Public
2022-09-16 04:00
Credits
Nicolas Joly Weinong Wang
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.775Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://github.com/kubernetes/kubernetes/issues/112513"
          },
          {
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231221-0005/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "kube-apiserver",
          "repo": "https://github.com/kubernetes/kubernetes",
          "vendor": "Kubernetes",
          "versions": [
            {
              "status": "affected",
              "version": "v1.25.0"
            },
            {
              "lessThanOrEqual": "v1.24.4",
              "status": "affected",
              "version": "v1.24.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "v1.23.10",
              "status": "affected",
              "version": "v1.23.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "v1.22.13",
              "status": "affected",
              "version": "v1.22.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "v1.25.1"
            },
            {
              "status": "unaffected",
              "version": "v1.24.5"
            },
            {
              "status": "unaffected",
              "version": "v1.23.11"
            },
            {
              "status": "unaffected",
              "version": "v1.22.14"
            },
            {
              "lessThanOrEqual": "v1.21.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Nicolas Joly"
        },
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Weinong Wang"
        }
      ],
      "datePublic": "2022-09-16T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A security issue was discovered in kube-apiserver that allows an \naggregated API server to redirect client traffic to any URL.  This could\n lead to the client performing unexpected actions as well as forwarding \nthe client\u0027s API server credentials to third parties.\u003cbr\u003e"
            }
          ],
          "value": "A security issue was discovered in kube-apiserver that allows an \naggregated API server to redirect client traffic to any URL.  This could\n lead to the client performing unexpected actions as well as forwarding \nthe client\u0027s API server credentials to third parties."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-560",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-560 Use of Known Domain Credentials"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-21T22:06:19.134Z",
        "orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
        "shortName": "kubernetes"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/kubernetes/kubernetes/issues/112513"
        },
        {
          "tags": [
            "mailing-list"
          ],
          "url": "https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231221-0005/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
    "assignerShortName": "kubernetes",
    "cveId": "CVE-2022-3172",
    "datePublished": "2023-11-03T18:11:53.835Z",
    "dateReserved": "2022-09-09T15:59:49.064Z",
    "dateUpdated": "2025-02-13T16:32:41.378Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-3172",
      "date": "2026-05-29",
      "epss": "0.03414",
      "percentile": "0.87642"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.21.14\", \"matchCriteriaId\": \"D740494E-6332-4421-BE43-C0CEB179CBA6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.22.0\", \"versionEndExcluding\": \"1.22.14\", \"matchCriteriaId\": \"57CC215D-A8DA-4D7F-8FF6-A1FC8451DEDD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.23.0\", \"versionEndExcluding\": \"1.23.11\", \"matchCriteriaId\": \"1E67C91E-260F-4C6B-BEE1-44B9C7F29C35\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.24.0\", \"versionEndExcluding\": \"1.24.5\", \"matchCriteriaId\": \"9D2847AF-B9A8-40FF-AED5-0BBAEF012BA9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:kubernetes:apiserver:1.25.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A049EC76-7250-484F-99AE-BBF05EA04225\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A security issue was discovered in kube-apiserver that allows an \\naggregated API server to redirect client traffic to any URL.  This could\\n lead to the client performing unexpected actions as well as forwarding \\nthe client\u0027s API server credentials to third parties.\\n\"}, {\"lang\": \"es\", \"value\": \"Se descubri\\u00f3 un problema de seguridad en kube-apiserver que permite que un servidor API agregado redirija el tr\\u00e1fico del cliente a cualquier URL. Esto podr\\u00eda llevar a que el cliente realice acciones inesperadas, as\\u00ed como a que reenv\\u00ede las credenciales del servidor API del cliente a terceros.\"}]",
      "id": "CVE-2022-3172",
      "lastModified": "2024-11-21T07:18:58.417",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"jordan@liggitt.net\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L\", \"baseScore\": 5.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 3.7}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\", \"baseScore\": 8.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 4.7}]}",
      "published": "2023-11-03T20:15:08.550",
      "references": "[{\"url\": \"https://github.com/kubernetes/kubernetes/issues/112513\", \"source\": \"jordan@liggitt.net\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak\", \"source\": \"jordan@liggitt.net\", \"tags\": [\"Mailing List\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20231221-0005/\", \"source\": \"jordan@liggitt.net\"}, {\"url\": \"https://github.com/kubernetes/kubernetes/issues/112513\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20231221-0005/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "jordan@liggitt.net",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"jordan@liggitt.net\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-918\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-918\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-3172\",\"sourceIdentifier\":\"jordan@liggitt.net\",\"published\":\"2023-11-03T20:15:08.550\",\"lastModified\":\"2025-02-13T17:15:42.960\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A security issue was discovered in kube-apiserver that allows an \\naggregated API server to redirect client traffic to any URL.  This could\\n lead to the client performing unexpected actions as well as forwarding \\nthe client\u0027s API server credentials to third parties.\"},{\"lang\":\"es\",\"value\":\"Se descubri\u00f3 un problema de seguridad en kube-apiserver que permite que un servidor API agregado redirija el tr\u00e1fico del cliente a cualquier URL. Esto podr\u00eda llevar a que el cliente realice acciones inesperadas, as\u00ed como a que reenv\u00ede las credenciales del servidor API del cliente a terceros.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"jordan@liggitt.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L\",\"baseScore\":5.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.0,\"impactScore\":3.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7}]},\"weaknesses\":[{\"source\":\"jordan@liggitt.net\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.21.14\",\"matchCriteriaId\":\"D740494E-6332-4421-BE43-C0CEB179CBA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.22.0\",\"versionEndExcluding\":\"1.22.14\",\"matchCriteriaId\":\"57CC215D-A8DA-4D7F-8FF6-A1FC8451DEDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.23.0\",\"versionEndExcluding\":\"1.23.11\",\"matchCriteriaId\":\"1E67C91E-260F-4C6B-BEE1-44B9C7F29C35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.24.0\",\"versionEndExcluding\":\"1.24.5\",\"matchCriteriaId\":\"9D2847AF-B9A8-40FF-AED5-0BBAEF012BA9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubernetes:apiserver:1.25.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A049EC76-7250-484F-99AE-BBF05EA04225\"}]}]}],\"references\":[{\"url\":\"https://github.com/kubernetes/kubernetes/issues/112513\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak\",\"source\":\"jordan@liggitt.net\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20231221-0005/\",\"source\":\"jordan@liggitt.net\"},{\"url\":\"https://github.com/kubernetes/kubernetes/issues/112513\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20231221-0005/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.