Traffic Redirection Flaw in Submariner

Executive Summary

This vulnerability in Submariner allows a malicious spoke cluster to redirect network traffic from other connected clusters by publishing a specially crafted network endpoint. The system fails to validate network subnets provided by the malicious cluster, enabling it to declare arbitrary ranges. Traffic intended for these ranges from peer clusters is rerouted through the attacker's tunnel, potentially leading to unauthorized information disclosure or network disruption.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unexpected network traffic redirection or unauthorized subnet advertisements in Submariner clusters. Check Submariner Endpoint configurations for arbitrary CIDR ranges like 10.0.0.0/8 or 0.0.0.0/0. Inspect WireGuard AllowedIPs and IPsec configurations for unvalidated remote subnets.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized information disclosure as attackers may intercept sensitive data. It can also cause network disruption by rerouting traffic, potentially leading to denial-of-service conditions or resource exhaustion. Attackers could inject arbitrary CIDRs, including large ranges, causing all matching traffic to be routed through their tunnel.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data interception or redirection, violating confidentiality requirements in GDPR and HIPAA. Non-compliance may result from unauthorized access to sensitive data, potential data breaches, and failure to protect personal or health information as mandated by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Isolate untrusted spoke clusters until patches are available. Monitor network traffic for anomalies. Review Submariner Endpoint configurations to ensure only valid subnets are advertised. Apply network policies to restrict unauthorized traffic redirection.

Useful 0 Not Useful 0