Listen to this Post
The vulnerability operates within Cilium’s network policy engine when processing `CiliumNetworkPolicy` resources that specify egress rules using the `toGroups` field with AWS security group IDs. Specifically, when the `egress.toGroups.aws.securityGroupsIds` array references security group IDs that are either non-existent in the associated AWS account or are not attached to any active network interface, Cilium’s policy derivation logic fails. This failure occurs during the internal translation process where Cilium queries AWS APIs to resolve the security group IDs into concrete CIDR ranges for inclusion in the `toCIDRSet` section of the enforced policy. If the resolution fails due to invalid or unattached security groups, the `toCIDRSet` section is not populated, resulting in a derived egress rule that lacks specific destination restrictions. Consequently, the egress rule defaults to being permissive, allowing outbound traffic from the affected pods to destinations beyond the intended scope. This flaw effectively bypasses the intended network segmentation, as the policy enforcement layer does not apply the expected CIDR-based filters. The issue is rooted in the error handling of the cloud provider integration, where unresolved references do not trigger a safe failure mode such as denying traffic. It requires a policy to be configured with the specific `toGroups` syntax targeting AWS, making it exploitable through misconfigurations or by an attacker with permissions to modify network policies in a vulnerable cluster.
Platform: Cilium
Version: v1.16.16, v1.17.0-9, v1.18.0-3
Vulnerability: Egress policy bypass
Severity: Medium
Date: Not disclosed
Prediction: Patched versions released
What Undercode Say:
Analytics
kubectl get ciliumnetworkpolicies -o yaml | grep -A5 -B5 "toGroups" cilium status --verbose helm list -n kube-system | grep cilium aws ec2 describe-security-groups --group-ids sg-xxx
How Exploit:
Create malicious CiliumNetworkPolicy referencing invalid AWS security group IDs. Abuse existing misconfigured policies for broader egress. Leverage policy update permissions.
Protection from this CVE:
Upgrade to patched versions: v1.16.17, v1.17.10, v1.18.4. Validate all referenced AWS security group IDs. Audit existing network policies.
Impact:
Unintended outbound access. Potential data exfiltration. Reduced network segmentation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
