# Holes in EndpointSlice Validation Enable Host Network Hijack

EndpointSlice validation is laxer than Endpoints, letting a user with Service/EndpointSlice create rights route traffic to arbitrary host-network ports like Fluent Bit admin.

- Payout: hidden
- Severity: low
- Program: Kubernetes
- Found by (vendor credit): John Howard
- Found by: howardjohn
- Disclosed: 2021-09-05
- CVE: CVE-2021-25737
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1145044
- Library page: https://bugbountylibrary.com/r/h1%3A1145044
- Tags: area:cloud domain:cloud impact:internal-access kind:bounty platform:hackerone sev:low tech:kubernetes technique:incomplete-fix technique:source-review vuln:access-control vuln:privilege-escalation

**Target:** kube-apiserver EndpointSlice admission validation
**Root cause:** EndpointSlice validation does not enforce the same port restrictions as Endpoints validation, so a slice can point at 127.0.0.1 with arbitrary ports.
**Steps:**
1. Create a Service `hijack` in namespace `attacker` with port 2020/TCP.
2. Create an EndpointSlice labeled `kubernetes.io/service-name: hijack` with address `127.0.0.1` and port 2020.
3. From a pod, `curl hijack.attacker:2020/api/v1/uptime` to reach the host-network Fluent Bit admin interface.
4. Repeat with other host ports to reach additional host services.
**How found:** Compared Endpoints validation (which rejects such configs) against the more lenient EndpointSlice validation code, hypothesizing the gap allowed host-network port targeting.
**Exploitation:** An unprivileged user creates a Service plus EndpointSlice pointing to 127.0.0.1 on a chosen port; kube-proxy programs routing so in-cluster requests to the service name reach the host-network service, exposing admin interfaces like Fluent Bit on 2020.
**Insight:** When a new API (EndpointSlice) reimplements an older one (Endpoints), diff their validation functions; the newer path often drops restrictions the old one enforced.