Description
KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint's error response handling.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kubesphere | kubesphere | ≤ 4.1.3 | — |
References
- GitHub Issue #6653 issue-tracking
- https://github.com/kubesphere/kubesphere product
- git.go - gitReadVerifyWithBasicAuth passes remoteUrl to origin.List unvalidated technical-description
- handler.go - VerifyGitCredential returns the go-git error to the caller technical-description
- globalroles.yaml - authenticated GlobalRole grants create on resources.kubesphere.io git technical-description
- VulnCheck Advisory: KubeSphere through 4.1.3 SSRF via git credential verification endpoint third-party-advisory