CVE-2023-3676
Published: 31 October 2023
Summary
CVE-2023-3676 is a high-severity Improper Input Validation (CWE-20) vulnerability in Kubernetes Kubernetes. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Kubernetes is affected by CVE-2023-3676, a privilege-escalation flaw that allows a user able to create pods on Windows nodes to obtain administrative privileges on those nodes. The vulnerability is present only in Kubernetes clusters that include Windows nodes and is classified under CWE-20 for improper input validation. It received a CVSS 3.1 base score of 8.8 reflecting network attack vector, low complexity, and low privileges required.
An authenticated user with pod-creation rights on a Windows node can leverage the issue to escalate to full administrative control of the node. The attack requires no user interaction and can be performed remotely within the cluster, enabling the attacker to compromise the host operating system and any workloads running on it.
Public advisories published by the Kubernetes project and vendors such as NetApp point to patches and configuration updates that address the flaw; links to the Kubernetes security-announce group and associated GitHub issues contain the remediation details. The EPSS score reached a peak of 0.4451 with a current value of 0.4074, indicating ongoing exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2686
Vulnerability details
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.
Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.
Directly implements checks on information inputs to reject invalid data before processing.
Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.