mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-01-31 15:53:33 +08:00
49 lines
1.9 KiB
YAML
49 lines
1.9 KiB
YAML
id: k8s-scheduler-bind-address
|
|
|
|
info:
|
|
name: Ensure kube-scheduler --bind-address is set to localhost
|
|
author: songyaeji
|
|
severity: high
|
|
description: |
|
|
Ensure kube-scheduler is bound to localhost (127.0.0.1 or ::1). If --bind-address is missing or set to
|
|
0.0.0.0 (::), the scheduler API may be reachable from all network interfaces, increasing exposure of the
|
|
control-plane component.
|
|
impact: |
|
|
If the kube-scheduler listens on all interfaces, an attacker with network access may be able to interact
|
|
with the scheduler API, causing potential information leakage or enabling further attacks against the cluster.
|
|
remediation: |
|
|
Set --bind-address=127.0.0.1 (or ::1) in the kube-scheduler startup arguments. For example, edit
|
|
/etc/kubernetes/manifests/kube-scheduler.yaml and add the argument to the command section.
|
|
reference:
|
|
- https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/
|
|
- Cloud Vulnerability Assessment Guide(2024) by KISA
|
|
tags: cloud,devops,kubernetes,devsecops,kube-scheduler,bind-address,hardening,k8s,k8s-cluster-security
|
|
|
|
variables:
|
|
component: "kube-scheduler"
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
kubectl get pods -n kube-system -l component=kube-scheduler -o jsonpath="{.items[*].spec.containers[*].command}"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- 'kube-scheduler'
|
|
|
|
- type: word
|
|
words:
|
|
- "--bind-address=127.0.0.1"
|
|
- "--bind-address=::1"
|
|
negative: true
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- '"kube-scheduler configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
|
|
# digest: 490a00463044022006a49804407d0d9b937760383c56604a16a549d8c45cb57b0ee1f8868b9e80c002204a7fb3c2364c55968c93e78151ce7a23232c10360bd6ffdc4ccd3c0c8aede23e:922c64590222798bb761d5b6d8e72950 |