CVE-2022-2835

Vulnerability

CVE-2022-2835 is a flaw in CoreDNS that arises when handling fully qualified domain name (FQDN) queries for internal Kubernetes services. The bug occurs in the plugin that processes service lookups in the format ..svc, allowing a malicious user to reroute internal calls to some internal services [2].

Exploitation

A remote attacker with the ability to craft DNS queries can exploit this by sending specially crafted requests that leverage the namespace-sensitive FQDN resolution. No authentication is required beyond network access to the DNS server, making this attack surface accessible to any client that can reach the CoreDNS instance [1][2].

Impact

Successful exploitation could redirect traffic intended for legitimate internal Kubernetes services to other services within the cluster. This can lead to data interception, service disruption, or further lateral movement depending on the attacker's objectives and the targeted service's permissions [2].

Mitigation

The vendor has acknowledged the issue; users should update to the latest patched version of CoreDNS. There are no known workarounds beyond applying the fix provided by the upstream project [1][2].