2021-01-02 04:59:06 +00:00
id : CVE-2019-11248
2020-08-19 14:33:23 +00:00
info :
2022-06-15 13:21:26 +00:00
name : Debug Endpoint pprof - Exposure Detection
2022-04-05 13:17:15 +00:00
author : 0xceeb , ritikchaddha
2021-09-10 11:26:40 +00:00
severity : high
2022-06-20 17:33:22 +00:00
description : |
The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
2021-03-30 06:50:02 +00:00
reference :
- https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
- http://mmcloughlin.com/posts/your-pprof-is-showing
2022-05-17 09:18:12 +00:00
- https://github.com/kubernetes/kubernetes/issues/81023
- https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJ
2022-06-15 13:21:26 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2019-11248
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
2022-04-22 10:38:41 +00:00
cvss-score : 8.2
2021-09-10 11:26:40 +00:00
cve-id : CVE-2019-11248
cwe-id : CWE-862
2022-06-20 17:33:22 +00:00
tags : cve,cve2019,debug,kubernetes,kubelet,devops,unauth,disclosure
2020-08-19 14:44:59 +00:00
2020-08-19 14:33:23 +00:00
requests :
- method : GET
path :
2020-08-19 14:44:59 +00:00
- "{{BaseURL}}/debug/pprof/"
2022-04-05 13:17:15 +00:00
- "{{BaseURL}}/debug/pprof/goroutine?debug=1"
stop-at-first-match : true
2020-08-19 14:33:23 +00:00
matchers :
- type : word
words :
- "Types of profiles available:"
2022-04-05 13:17:15 +00:00
- "Profile Descriptions"
- "goroutine profile: total"
condition : or
2022-06-15 13:21:26 +00:00
# Enhanced by mp on 2022/06/15
