Skip to content

Directory traversal (or path traversal)? #77182

Closed
@warmchang

Description

What happened:

Initial submission is in k3s repo, but after verification and Darren's reminder, it also exists in kubernetes.

TL;DR k3s-io/k3s#387

Accessing the "https://k8s-server:6443/logs/" reveals the details of the /var/log directory and the contents of all the files below.

What you expected to happen:
Kubernetes users cann't view all the files & directories in the /var/log path.

How to reproduce it (as minimally and precisely as possible):
Step by step: k3s-io/k3s#387 (comment)

20190418095100
image

Anything else we need to know?:
N/A

Environment:

  • Kubernetes version (use kubectl version): v1.14.1
  • Cloud provider or hardware configuration: VM on openstack
  • OS (e.g: cat /etc/os-release): Fedora 29 (Cloud Edition)
  • Kernel (e.g. uname -a): Linux william 5.0.9-200.fc29.x86_64 Unit test coverage in Kubelet is lousy. (~30%) #1 SMP Mon Apr 22 00:55:30 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
  • Install tools: Manual
  • Network plugin and version (if this is a network-related bug): N/A
  • Others: N/A

Metadata

Assignees

No one assigned

    Labels

    kind/bugCategorizes issue or PR as related to a bug.needs-sigIndicates an issue or PR lacks a `sig/foo` label and requires one.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions