Exposed pprof

Jijith Rajan

Published on

10 Jan 2022

Vulnerability

Description

The unauthenticated Kubelet healthz port exposes the debugging endpoint /debug/pprof. The Kubelet’s healthz port exposes the go pprof endpoint.

Debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.

Recommendations

Update to the latest version

Automated human-like penetration testing for your web apps & APIs

Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Product tour

Written by