CyberRota Analysis
AI-GeneratedKubernetes deployments using Kyverno versions prior to v1.13.4 are susceptible to server-side request forgery (SSRF) through the Service Call functionality, allowing attackers with policy creation permissions to specify external URLs. This vulnerability can lead to the exfiltration of sensitive cluster data, including Kubernetes resource contents like secrets, to an attacker-controlled server. Organizations utilizing Kyverno should prioritize upgrading to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.