CVE-2019-11246: medium-severity vulnerability in Kubernetes
kubectl cp allows symlink directory traversal
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The kubectl cp command can be exploited if a container has a malicious tar binary, allowing an attacker to write files anywhere on the user's machine when copying files from that container. This happens because kubectl unpacks the tar archive without proper validation of its contents.
kubectl cp executes tar inside the container and unpacks the resulting archive on the local machine without validating symlinks or path traversal attempts. An attacker controlling the container's tar binary can output malicious tar streams with directory traversal sequences (CWE-61), writing files to arbitrary locations on the host machine within the local user's permission scope.
In the same product, most dangerous first.