# Bypass apiserver proxy filter

Kubernetes apiserver proxy filter does two DNS lookups for hostname node addresses; a custom DNS server returning different answers with zero TTL bypasses the filter to reach metadata/localhost.

- Payout: hidden
- Severity: medium
- Program: Kubernetes
- Found by (vendor credit): Javier Provecho
- Found by: javierprovecho
- Disclosed: 2021-05-27
- CVE: CVE-2020-8562
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/859962
- Library page: https://bugbountylibrary.com/r/h1%3A859962
- Tags: area:cloud domain:cloud impact:internal-access kind:bounty platform:hackerone sev:medium tech:kubernetes technique:race-window vuln:access-control vuln:race-condition vuln:ssrf

**Target:** apiserver node proxy filter (kubectl proxy /api/v1/nodes/<name>:<port>/proxy/)
**Root cause:** The apiserver resolves a node's DNS-type address once to validate it against the proxy filter and again when actually proxying, so a DNS server that answers differently per query defeats the check.
**Steps:**
1. Stand up a DNS server on UDP/53 and delegate a subdomain (e.g. fake.example.com) to it via NS record.
2. Run a custom DNS server that returns different answers to consecutive queries with zero TTL.
3. Create a KIND cluster and a Node whose address is a hostname under the delegated zone (e.g. toctou.fake.example.com).
4. Start `kubectl proxy` and request `curl localhost:8001/api/v1/nodes/toctou:80/proxy/`.
**How found:** Noticed the apiserver performs two separate DNS resolutions for hostname-type node addresses (check vs use) and hypothesized a custom DNS server with zero TTL could return different values.
**Exploitation:** Attacker with node-create rights sets a node address to a hostname on an attacker-controlled DNS zone; first lookup passes filter validation, second lookup resolves to a forbidden target (cloud metadata or localhost), and the proxied request reaches it.
**Escalation:** Reaching cloud metadata endpoints or localhost services from the apiserver; especially impactful for Kubernetes-as-a-service providers like oneinfra.
**Insight:** When a security filter resolves a hostname and the sink resolves it again, control the DNS zone and answer differently per query with TTL 0 to split check from use.