CVE-2019-11251 is a vulnerability in Kubernetes
Published on February 3, 2020

kubectl cp allows symlink directory traversal
The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

NVD

Vulnerability Analysis

CVE-2019-11251 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

HIGH

Privileges Required:

LOW

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

NONE

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Type

What is a Symlink following Vulnerability?

The software, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the software to operate on unauthorized files. A software system that allows UNIX symbolic links (symlink) as part of paths whether in internal code or through user input can allow an attacker to spoof the symbolic link and traverse the file system to unintended locations or access arbitrary files. The symbolic link can permit an attacker to read/write/corrupt a file that they originally did not have permissions to access.

CVE-2019-11251 has been classified to as a Symlink following vulnerability or weakness.

Products Associated with CVE-2019-11251

Want to know whenever a new CVE is published for Kubernetes? stack.watch will email you.

Kubernetes

Affected Versions

Kubernetes:

Version prior to 1.13.11 is affected.
Version prior to 1.14.7 is affected.
Version prior to 1.15.4 is affected.
Version 1.1 is affected.
Version 1.2 is affected.
Version 1.3 is affected.
Version 1.4 is affected.
Version 1.5 is affected.
Version 1.6 is affected.
Version 1.7 is affected.
Version 1.8 is affected.
Version 1.9 is affected.
Version 1.10 is affected.
Version 1.11 is affected.
Version 1.12 is affected.

Exploit Probability

EPSS

3.45%

Percentile

87.34%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.