.. / CVE-2022-45933

• Info Disclosure
• Nuclei
• Web

Exploit for KubeView <=0.1.31 - Information Disclosure (CVE-2022-45933)

Description:

KubeView through 0.1.31 is susceptible to information disclosure. An attacker can obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication and retrieves certificate files that can be used for authentication as kube-admin. An attacker can thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Nuclei Template

View the template here CVE-2022-45933.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-45933.yaml

References: