id: CVE-2019-11248

info:
  name: Debug Endpoint pprof - Exposure Detection
  author: 0xceeb,ritikchaddha
  severity: high
  description: |
    The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
  impact: |
    An attacker can exploit this vulnerability to gather sensitive information, potentially leading to further attacks.
  remediation: |
    Disable or restrict access to the Debug Endpoint pprof to prevent unauthorized access.
  reference:
    - https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
    - http://mmcloughlin.com/posts/your-pprof-is-showing
    - https://github.com/kubernetes/kubernetes/issues/81023
    - https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJ
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11248
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
    cvss-score: 8.2
    cve-id: CVE-2019-11248
    cwe-id: CWE-862,CWE-419
    epss-score: 0.55625
    epss-percentile: 0.97666
    cpe: cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: kubernetes
    product: kubernetes
    shodan-query: http.title:"kubernetes web view"
    fofa-query:
      - title="kubernetes web view"
      - app="kubernetes-enterprise-manager"
    google-query: intitle:"kubernetes web view"
  tags: cve2019,cve,debug,kubernetes,kubelet,devops,unauth,disclosure

http:
  - method: GET
    path:
      - "{{BaseURL}}/debug/pprof/"
      - "{{BaseURL}}/debug/pprof/goroutine?debug=1"

    stop-at-first-match: true
    matchers:
      - type: word
        words:
          - "Types of profiles available:"
          - "Profile Descriptions"
          - "goroutine profile: total"
        condition: or
# digest: 4b0a00483046022100e657ba9f27d9c568c2277e20ab68f160fd31203471a7943bdb8b24d85ab697de022100cc0aea703272ca6817e298be4071ab1d695c422e53bb5a8c69d213f38f1e8be7:922c64590222798bb761d5b6d8e72950