CVE-2019-11251: medium-severity vulnerability in Kubernetes
kubectl cp allows symlink directory traversal
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The kubectl cp command in Kubernetes can be tricked by a malicious container to write files outside the intended destination folder using symlinks. An attacker could exploit this to place harmful files in unexpected locations on your system.
The kubectl cp command fails to properly validate symlinks in tar archives from container output, allowing directory traversal via chained symlinks. An attacker controlling a container can craft tar output with symlinks that bypass destination directory restrictions, enabling arbitrary file placement on the host running kubectl.
In the same product, most dangerous first.