MCP Server Kubernetes Command Injection Vulnerability (CVE-2022-35355) Analysis

Key Information Vulnerability Overview CVE ID: CVE-2022-35355 Vulnerability Type: Command Injection Affected Version: MCP Server Kubernetes 4.2.0 Fixed Version: 4.2.1 Vulnerability Description Multiple tools in MCP Server Kubernetes are affected by a command injection vulnerability. Attackers can execute arbitrary system commands by injecting malicious commands into specific configuration options. Vulnerability Details Affected Components: Multiple tools in MCP Server Kubernetes Attack Vector: Attackers can exploit configuration options in these tools to inject malicious commands and execute arbitrary system commands. Example Code: Vulnerable code snippets and patched code snippets are provided. PoC (Proof of Concept) Indirect Command Injection via Pod Logs - Create a Pod log containing malicious commands. - Trigger command execution when viewing logs using . Using MCP Inspector - Trigger command execution via specific API requests. Using Kube Tool - Trigger command execution via specific API requests. Using Web Client UI 图示特定的UI操作触发命令执行。 Mitigation Upgrade to MCP Server Kubernetes 4.2.1 or later. Implement strict validation and sanitization of all user inputs to prevent them from being used as command-line arguments. Impact May lead to remote code execution, potentially allowing full control over the affected system. References GitHub Advisory [Other Related Links] Similar Issues [List of Similar Security Vulnerabilities]

Goal Reached Thanks to every supporter — we hit 100%!

MCP Server Kubernetes Command Injection Vulnerability (CVE-2022-35355) Analysis

More from this source