id: kubernetes-pods-api

info:
  name: Kubernetes Pods - API Discovery & Remote Code Execution
  author: ilovebinbash,geeknik,0xtavian
  severity: critical
  description: A Kubernetes Pods API was discovered. When the service port is available, unauthenticated users can execute commands inside the container.
  reference:
    - https://github.com/officialhocc/Kubernetes-Kubelet-RCE
    - https://blog.binaryedge.io/2018/12/06/kubernetes-being-hijacked-worldwide/
  metadata:
    max-request: 2
  tags: k8,unauth,kubernetes,devops,misconfig

http:
  - method: GET
    path:
      - '{{BaseURL}}/pods'
      - '{{BaseURL}}/api/v1/pods'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "apiVersion"

      - type: word
        words:
          - "application/json"
        part: header

      - type: status
        status:
          - 200
# digest: 490a0046304402202a640bead9900df7cb5f22bb8dad6df68d2ff5d079de5ef454cd20f4b2b24f140220192e113778ffd9052ee725be31cc34ed921b4f01976440f2927f22ea06c3e4f5:922c64590222798bb761d5b6d8e72950