Kubernetes Admins Warned to Patch Clusters Against New RCE Vulns
14-Sep-23
All Windows endpoints on an unpatched cluster are vulnerable to remote code execution (RCE) with system privileges due to two new high-severity Kubernetes vulnerabilities. In a recent research, Akamai identified the two Kubernetes vulnerabilities and encouraged system administrators to fix them right away.
According to the Akamai report, the discovery was based on prior investigation into the Windows nodes vulnerability CVE-2023-3676, which was revealed in July. After further investigation by Akamai, it was discovered that after successfully exploiting the Windows nodes weakness, a hacker might switch to utilizing the further command injection bugs listed as CVE-2023-3893 and 2023-3955. The researchers claim that both follow-on issues have the same root cause, which is “insecure function call and lack of user input sanitization.”
