Kubetier
T2nodes/proxy DNS rebinding blocklist bypass

  1. Register a fake Node with a DNS rebinding hostname that initially resolves to a valid public IP

  2. API server checks isProxyableHost before connecting.

    At check time, DNS resolves to the allowed IP

  3. By connect time, DNS flips to 127.0.0.1 or 169.254.x.x.

    The blocklist check is not re-run (TOCTOU)

  4. SSRF reaches loopback services such as kube-proxy :10249 configz, etcd :2379, and control-plane localhost ports

Rights needed:

Note:

This is a wontFix.

Fixing requires IP pinning between check and connect, which breaks split-horizon DNS.

Mitigation is dnsmasq min-cache-ttl.

K8s docs ↗