# Compromise of node can lead to compromise of pods on other nodes

A compromised node's fake kubelet issues 301 redirects, tricking kubectl into forwarding its bearer token and exec requests to pods on other nodes.

- Payout: hidden
- Severity: medium
- Program: Kubernetes
- Found by (vendor credit): Wouter ter Maat of Offensi
- Found by: wtm
- Disclosed: 2020-10-30
- CVE: CVE-2020-8559
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/863979
- Library page: https://bugbountylibrary.com/r/h1%3A863979
- Tags: area:cloud domain:cloud impact:internal-access impact:rce kind:bounty platform:hackerone sev:medium tech:kubernetes technique:chained vuln:access-control vuln:auth-bypass

**Target:** kubelet/kubectl exec API on port 10250/10255
**Root cause:** kubectl follows 301 redirects from kubelet and resends the Authorization bearer token to the redirect target, so a malicious kubelet can proxy authenticated exec requests to arbitrary nodes.
**Steps:**
1. Escape a privileged container to gain node access
2. Kill kubelet: `kill -9 $(pidof kubelet)` and run fakekubelet.py on port 10250/10255
3. Wait for kubectl `POST /exec/default/hello-server-.../hello-app?command=%2Fbin%2Fs&input=1&output=1&tty=1`
4. Respond `HTTP/1.1 301` with `Location: https://10.138.0.8/exec/default/victim-.../nginx?command=/bin/arbitrary_command_here&error=1&input=1&output=1&tty=0`
5. kubectl follows redirect, resends bearer token, and executes arbitrary command on victim node/pod
**How found:** Observed that kubectl resends the Authorization bearer token on 301 redirects and that kubelet's exec endpoint is reachable on 10250/10255, hypothesizing a fake kubelet could proxy authenticated requests to other nodes.
**Exploitation:** Attacker with node access replaces kubelet with a fake server that 301-redirects incoming exec requests to a victim node's kubelet; kubectl follows the redirect and resends its Authorization header, causing arbitrary command execution in the victim pod, bypassing node-to-node firewall rules.
**Escalation:** Redirect can target any node including the master, enabling lateral movement across the cluster from a single compromised node.
**Insight:** Client redirect-following that preserves Authorization headers lets a compromised server pivot authenticated requests to arbitrary hosts; test whether kubectl/API clients resend credentials across 301 to bypass network segmentation.