Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources
Affects github.com/zxh326/kiteSource GCVE Database
- Patch
- Available – fixed in 0.14.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Gogithub.com/zxh326/kite | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade Kite to version 0.14.1 or later, where this vulnerability is fixed. If immediate upgrade is not possible, implement reverse proxy rules to reject encoded dot segments (%2e%2e) and encoded slashes in requests to Kite. Additionally, restrict the permissions of Kite's Kubernetes service account to minimize potential exposure. Note that reverse proxy normalization is a temporary workaround and should not be considered a permanent fix.
Description
Kite versions 0.6.9 through 0.14.0 contain a path traversal vulnerability in the Kubernetes proxy feature that allows authenticated users with limited namespace permissions to bypass RBAC restrictions and read cluster-wide resources. The vulnerability arises because encoded path traversal segments are decoded after authorization checks, enabling access to Kubernetes API endpoints outside the authorized namespace. This can lead to disclosure of sensitive cluster-wide information, including Secrets. The issue is fixed in version 0.14.1.
Impact
An authenticated user with limited 'get' permissions in a single namespace can leverage this vulnerability to access Kubernetes API endpoints outside their authorized namespace, potentially disclosing sensitive cluster-wide resources such as Secrets. The impact is confidentiality loss only; integrity and availability are not affected. The extent of exposure depends on the permissions granted to Kite's Kubernetes service account. Deployments with restricted service accounts are limited to those permissions.
Summary
Kite's Kubernetes proxy authorization checks are performed against the original namespace and resource kind parameters, but the proxy path is later decoded and normalized, allowing encoded path traversal sequences (e.g., %2e%2e) to redirect requests to unauthorized Kubernetes API endpoints. Authenticated users with 'get' permission on pods or services in one namespace can exploit this to read resources in other namespaces, including cluster-wide Secrets, using Kite's service account. The vulnerability affects Kite versions from 0.6.9 up to but not including 0.14.1. The impact is limited to confidentiality breaches; no resource modification or denial of service has been demonstrated. The issue was fixed in Kite 0.14.1.
Weaknesses
References
- github.com/kite-org/kite/security/advisories/GHSA-c534-2w9c-x7fm (opens in a new tab)
- github.com/kite-org/kite/pull/638 (opens in a new tab)
- github.com/kite-org/kite/commit/08116eed557f8d6982cc83af0b02991e0f3577d5 (opens in a new tab)
- github.com/kite-org/kite/commit/69ad938937af8f375a2e183d1a331926ab851d98 (opens in a new tab)
- github.com/kite-org/kite (opens in a new tab)
- github.com/kite-org/kite/releases/tag/v0.14.1 (opens in a new tab)