document api access vulnerabilities (#205)

* document apiinfodisclosure vuln

* fix relative url

docs/kb/KHV007.md

@@ -0,0 +1,20 @@
+---
+id: KHV007
+title: Specific Access to Kubernetes API
+categories: [Access Risk]
+---
+
+# KHV007 - Specific Access to Kubernetes API
+
+## Issue description
+
+kube-hunter was able to perform the action specified by the reported vulnerability (check the report for more information). This may or may not be a problem, depending on your cluster setup and preferences.
+
+## Remediation
+
+Review the RBAC permissions to Kubernetes API server for the anonymous and default service account.
+
+## References
+
+- [Using RBAC Authorization](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)
+- [KHV005 - Access to Kubernetes API]({{ site.baseurl }}{% link kb/KHV005.md %})

src/modules/hunting/apiserver.py

@@ -41,7 +41,7 @@ class ApiInfoDisclosure(Vulnerability, Event):
             name +=" using service account token"
         else:
             name +=" as anonymous user"
-        Vulnerability.__init__(self, KubernetesCluster, name=name, category=InformationDisclosure)
+        Vulnerability.__init__(self, KubernetesCluster, name=name, category=InformationDisclosure, vid="KHV007")
         self.evidence = evidence
 
 class ListPodsAndNamespaces(ApiInfoDisclosure):