mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-22 03:10:42 +08:00
34 lines
962 B
YAML
34 lines
962 B
YAML
id: kubernetes-pods-api
|
|
|
|
info:
|
|
name: Kubernetes Pods - API Discovery & Remote Code Execution
|
|
author: ilovebinbash,geeknik,0xtavian
|
|
severity: critical
|
|
description: |-
|
|
A Kubernetes Pods API was discovered. When the service port is available, unauthenticated users can execute commands inside the container.
|
|
reference:
|
|
- https://github.com/officialhocc/Kubernetes-Kubelet-RCE
|
|
- https://blog.binaryedge.io/2018/12/06/kubernetes-being-hijacked-worldwide/
|
|
tags: k8,unauth,kubernetes,devops,misconfig
|
|
created: 2025/07/14
|
|
|
|
rules:
|
|
r0:
|
|
brute:
|
|
mode: clusterbomb
|
|
commit: winner
|
|
continue: false
|
|
p:
|
|
- /pods
|
|
- /api/v1/pods
|
|
- /runningpods/
|
|
request:
|
|
method: GET
|
|
path: "{{p}}"
|
|
expression: |
|
|
response.status == 200 &&
|
|
response.body.bcontains(b'"apiVersion":') &&
|
|
response.body.bcontains(b'"items":') &&
|
|
response.body.bcontains(b'"kind":')
|
|
expression: r0()
|