Unpatchable Vulnerabilities of Kubernetes: CVE-2020-8554

This article explains CVE-2020-8554, an unpatchable Kubernetes vulnerability that allows a user who can create Service objects to hijack traffic intended for external IP addresses by leveraging ExternalIP services and kube-proxy’s iptables rules. It shows a proof-of-concept redirecting traffic for icanhazip.com to an in-cluster echoserver, describes how kube-proxy generates NAT rules for services, and outlines mitigations such as blocking ExternalIP services with DenyServiceExternalIPs or Kyverno and using Cilium’s kube-proxy replacement. #CVE-2020-8554 #kube-proxy

Keypoints

Kubernetes contains four “unpatchable” vulnerabilities related to container networking; CVE-2020-8554 is the first discussed and allows service-based traffic redirection.
The exploit relies on a hostile cluster user being able to create Service objects that specify externalIPs, enabling redirection of traffic destined for arbitrary external addresses into the cluster.
Kube-proxy implements service networking by creating iptables (or IPVS/nftables) NAT rules on each node; ExternalIP services create rules that match external IPs and forward them to pods.
A proof-of-concept Service redirects traffic for 104.16.185.241 and 104.16.184.241 (icanhazip.com) to an echoserver pod, demonstrated via iptables chains and entries.
Mitigations include blocking ExternalIP services using the DenyServiceExternalIPs admission controller, policy controllers like Kyverno, GitOps lifecycle checks, or using Cilium’s kube-proxy replacement which is not affected.
Risk prioritization depends on the threat model: if cluster users are few and fully trusted, the vulnerability may be lower priority; otherwise operators should enforce controls to prevent Service creation abuse.

MITRE Techniques

Indicators of Compromise

[IP Address ] External IPs used in PoC service – 104.16.185.241, 104.16.184.241
[Domain ] Targeted external domain in example – icanhazip.com
[Kubernetes Service names ] Service objects shown in examples and PoC – mitm-externalip, nginx-service
[Cluster/Pod IPs ] Internal cluster and pod addresses referenced in iptables rules – 10.96.206.161, 10.96.96.147 (and other pod IPs such as 10.244.0.6, 10.244.0.10)