CVE-2022-2837

Vulnerability

Description A flaw in CoreDNS, a DNS server/forwarder, allows a malicious user to redirect traffic intended for external top-level domains (TLDs) to a pod they control. This is achieved by creating projects and namespaces that match the TLD. The vulnerability arises from how CoreDNS handles DNS queries for external domains when integrated with Kubernetes, as it may resolve namespaces as authoritative for those domains.

Exploitation

An attacker with the ability to create namespaces or projects in a Kubernetes cluster can exploit this flaw. By creating a namespace that matches an external TLD (e.g., "com"), CoreDNS may incorrectly treat queries for domains under that TLD as local queries, redirecting them to a pod controlled by the attacker. No authentication beyond namespace creation privileges is required.

Impact

Successful exploitation allows the attacker to intercept and potentially modify DNS responses for external top-level domains. This can lead to traffic redirection, data exfiltration, or man-in-the-middle attacks, compromising the confidentiality and integrity of network communications.

Mitigation

As of the publication date (2023-03-03), users should update CoreDNS to a patched version if available. The CoreDNS project is maintained on GitHub [1], and the NVD entry [2] provides details. Administrators should also review namespace creation permissions and consider network policies to limit exposure.