CyberRota Analysis
AI-GeneratedKubeSphere versions up to 4.1.3 are vulnerable to a server-side request forgery (SSRF) flaw in the git credential verification endpoint, which improperly handles unvalidated URLs. This vulnerability allows authenticated attackers to exploit the endpoint to access internal services and exfiltrate sensitive basic-auth credentials from Secrets across all namespaces. Organizations using KubeSphere should prioritize patching this vulnerability to mitigate the risk of credential exposure and potential internal network compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint's error response handling.