Arbitrary Code Execution in kube-compare via Untrusted Container Image

Executive Summary

This vulnerability exists in the kube-compare tool. When processing a 'container://' reference path, it incorrectly runs an untrusted container image's entrypoint instead of extracting data from a stopped container. This allows a remote attacker to execute arbitrary code on the operator's workstation. If Docker requires elevated privileges, the untrusted code may run with root permissions, creating a significant security risk.

Useful 0 Not Useful 0

Detection Guidance

Check if kube-compare is installed and inspect container:// references in your configurations. Look for unexpected container executions or network connections from kube-compare processes. Commands like 'ps aux | grep kube-compare' or 'docker ps -a' may help identify suspicious activity.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to run malicious code on your workstation. If Docker requires sudo, the attacker could gain root access, allowing them to install malware, steal data, or take control of your system. Even without root, they could perform actions like deleting files or exfiltrating sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. This may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, depending on the data involved. Organizations using kube-compare with untrusted containers risk non-compliance and potential regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Stop using untrusted container images with kube-compare. Ensure Docker or Podman requires authentication and restricts privileged access. Review sudo policies to limit Docker command execution to trusted users. Avoid using the container:// scheme with untrusted sources until a patch is available.

Useful 0 Not Useful 0