CVE-2019-11249: medium-severity vulnerability in Kubernetes
kubectl cp allows symlink directory traversal
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The kubectl cp command can be exploited through a malicious tar binary in a container to write files to any location on the user's machine. An attacker with control over the container can execute arbitrary code and place files anywhere the local user has permission to write.
kubectl cp unpacks tar archives from containers without proper validation of symlinks or path traversal. An attacker controlling the container's tar binary can output malicious content (symlinks, absolute paths) that kubectl unpacks on the host system, enabling arbitrary file writes within the local user's permission scope. Affected versions prior to 1.13.9, 1.14.5, and 1.15.2.
In the same product, most dangerous first.