kube-hunter/docs/_kb/KHV042.md

vid, title, categories

vid	title	categories
KHV042	Exposed Attaching To Container	Remote Code Execution

{{ page.vid }} - {{ page.title }}

Issue description

An attacker could attach to a running container via a websocket on the kubelet's /attach endpoint. This endpoint is exposed as part of the kubelet's debug handlers.

Remediation

Disable --enable-debugging-handlers kubelet flag.

References

• kubelet server code
• Kubelet - options