mirror of
https://github.com/aquasecurity/kube-hunter.git
synced 2026-08-23 22:26:23 +00:00
24 lines
963 B
Markdown
24 lines
963 B
Markdown
---
|
|
vid: KHV052
|
|
title: Exposed Pods
|
|
categories: [Information Disclosure]
|
|
severity: high
|
|
---
|
|
|
|
# {{ page.vid }} - {{ page.title }}
|
|
|
|
## Issue description
|
|
|
|
An attacker could view sensitive information about pods that are bound to a Node using the exposed /pods endpoint
|
|
This can be done either by accessing the readonly port (default 10255), or from the secure kubelet port (10250)
|
|
|
|
## Remediation
|
|
|
|
Ensure kubelet is protected using `--anonymous-auth=false` kubelet flag. Allow only legitimate users using `--client-ca-file` or `--authentication-token-webhook` kubelet flags. This is usually done by the installer or cloud provider.
|
|
|
|
Disable the readonly port by using `--read-only-port=0` kubelet flag.
|
|
|
|
## References
|
|
|
|
- [Kubelet configuration](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/)
|
|
- [Kubelet authentication/authorization](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/) |