KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade scheduling.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Linuxfoundation Kubeedge
cpe:2.3:a:linuxfoundation:kubeedge:*:*:*:*:*:*:*:*
|
— |
<= 1.23.1
|
References 5
https://github.com/geo-chen/oss/blob/main/kubeedge.md
NVD
https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/ht…
NVD
https://github.com/kubeedge/kubeedge/blob/v1.23.1/cloud/pkg/cloudhub/servers/ht…
NVD
https://github.com/kubeedge/kubeedge
NVD
https://www.vulncheck.com/advisories/kubeedge-cloudcore-through-1.23.1-missing-…
VulnCheck Advisory: KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints