Skip to content
Nuclei Templates

Debug Endpoint pprof - Exposure Detection

ID: CVE-2019-11248

Severity: high

Author: 0xceeb,ritikchaddha

Tags: cve2019,cve,debug,kubernetes,kubelet,devops,unauth,disclosure

Description

Section titled “Description”

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.

YAML Source

Section titled “YAML Source”
id: CVE-2019-11248


info:
  name: Debug Endpoint pprof - Exposure Detection
  author: 0xceeb,ritikchaddha
  severity: high
  description: |
    The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
  impact: |
    An attacker can exploit this vulnerability to gather sensitive information, potentially leading to further attacks.
  remediation: |
    Disable or restrict access to the Debug Endpoint pprof to prevent unauthorized access.
  reference:
    - https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
    - http://mmcloughlin.com/posts/your-pprof-is-showing
    - https://github.com/kubernetes/kubernetes/issues/81023
    - https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJ
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11248
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
    cvss-score: 8.2
    cve-id: CVE-2019-11248
    cwe-id: CWE-862,CWE-419
    epss-score: 0.55625
    epss-percentile: 0.97666
    cpe: cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: kubernetes
    product: kubernetes
    shodan-query: http.title:"kubernetes web view"
    fofa-query:
      - title="kubernetes web view"
      - app="kubernetes-enterprise-manager"
    google-query: intitle:"kubernetes web view"
  tags: cve2019,cve,debug,kubernetes,kubelet,devops,unauth,disclosure


http:
  - method: GET
    path:
      - "{{BaseURL}}/debug/pprof/"
      - "{{BaseURL}}/debug/pprof/goroutine?debug=1"


    stop-at-first-match: true
    matchers:
      - type: word
        words:
          - "Types of profiles available:"
          - "Profile Descriptions"
          - "goroutine profile: total"
        condition: or
# digest: 4a0a00473045022100fdeb98efb409822dcd47bddde1a7f7007d54905deeb28e2f3053c23ed1642302022079c590451dda7875816c9cf10f1366776f8d94391ecfd77862b49b02bad815eb:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-11248.yaml"

View on Github