ANSI escape characters in kubectl output are not being filtered #101695

g3rzi · 2021-05-02T12:06:24Z

It is a security issue, but after contacting [email protected], Tim and the team confirmed that they are comfortable posting it publicly.

What happened:

Kubernetes doesn't sanitize the 'message' field in the Event JSON objects.
Notice that this is relevant only to JSON objects, not YAML objects.
By creating new event, we can insert ANSI escape characters inside the "message" field, like:

"\u001b[2J\u001b[3J\u001b[1;1H\u001b[m spoofed \u001b[60C\u001b[1;0m. Done"

This an example of such JSON request:

{
    "apiVersion": "v1",
    "involvedObject": {
        "kind": "Node",
        "name": "node01",
        "uid": "node01"
    },
    "kind": "Event",
    "message": "\u001b[2J\u001b[3J\u001b[1;1H\u001b[m spoofed \u001b[60C\u001b[1;0m. Done",
    "metadata": {
        "name": "spoofEvent",
        "namespace": "default"
    },
    "source": {
        "component": "kubelet",
        "host": "node01"
    },
    "type": "Normal"
}

The codes:
\u001b[2J -> Clean the screen and history
\u001b[3J -> Clean the entire screen and delete all lines saved in the scrollback buffer
\u001b[1;1H -> Moves the cursor position to row 1, column 1 (beginning).
\u001b[m -> Set the colors
\u001b[60C -> Move the cursor forward 60 steps
\u001b[1;1m -> Set the text colors to white

The result is that the text was spoofed, and we could spoof the events, create hidden events, or hide other events.

What you expected to happen:

The ANSI escape characters will be filtered so they couldn't affect the terminal (i.e. using embeded ANSI colors won't do anything to the terminal).
Or maybe some message that says that you can't use ANSI escape characters.

How to reproduce it (as minimally and precisely as possible):

Run this code:


kubectl create -f - <<EOF
{
    "apiVersion": "v1",
    "involvedObject": {
        "kind": "Node",
        "name": "node01",
        "uid": "node01"
    },
    "kind": "Event",
    "message": "\u001b[2J\u001b[3J\u001b[1;1H\u001b[m spoofed \u001b[60C\u001b[1;0m. Done",
    "metadata": {
        "name": "spoofEvent",
        "namespace": "default"
    },
    "source": {
        "component": "kubelet",
        "host": "node01"
    },
    "type": "Normal"
}
EOF

It will create a new event.

Run kubectl get events, you will see that the screen was clear, you will get a "spoof" message, and all the rest events or columns were gone.

Anything else we need to know?:

It might look like a low severity issue, but there are other variety of things we can do, from DoS by using colors to hide all the events, changing the title of the terminal window, and spoof the data.

It can affect other systems that are using Kubernetes events, such as monitoring applications. It doesn't have to be only the Kubernetes events. There might be other vulnerable objects that we didn't find or other systems that create new objects that count on this mechanism.

ANSI escape characters were used to abuse terminals emulators and even cause code execution if the terminal is vulnerable (like CVE-2003-0069).

Environment:

Kubernetes version (use kubectl version):

Client Version: version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.4", GitCommit:"e87da0bd6e03ec3fea7933c4b5263d151aafd07c", GitTreeState:"clean", BuildDate:"2021-02-18T16:12:00Z", GoVersion:"go1.15.8", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.2", GitCommit:"faecb196815e248d3ecfb03c680a4507229c2a56", GitTreeState:"clean", BuildDate:"2021-01-13T13:20:00Z", GoVersion:"go1.15.5", Compiler:"gc", Platform:"linux/amd64"}

Cloud provider or hardware configuration:
OS (e.g: cat /etc/os-release):

NAME="Ubuntu"
VERSION="16.04.7 LTS (Xenial Xerus)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 16.04.7 LTS"
VERSION_ID="16.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
VERSION_CODENAME=xenial
UBUNTU_CODENAME=xenial

Kernel (e.g. uname -a):

Linux manager1 4.15.0-140-generic #144~16.04.1-Ubuntu SMP Fri Mar 19 21:24:12 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

Install tools: minikube

minikube version: v1.19.0
commit: 15cede53bdc5fe242228853e737333b09d4336b5

Network plugin and version (if this is a network-related bug):
Others: we also reproduced it in Kubernetes (not minikube) version 1.18

The text was updated successfully, but these errors were encountered:

g3rzi · 2021-05-05T06:53:58Z

/sig api-machinery

pacoxu · 2021-05-06T09:46:15Z

[root@daocloud print]# kubectl get event > test.events &&  cat --show-nonprinting  test.events
LAST SEEN   TYPE     REASON           OBJECT                                  MESSAGE
44s         Normal   SandboxChanged   pod/nginx-deployment-7969cc74c6-9b9z7   Pod sandbox changed, it will be killed and re-created.
103s        Normal   SandboxChanged   pod/nginx-deployment-7969cc74c6-f87gt   Pod sandbox changed, it will be killed and re-created.
54s         Normal   SandboxChanged   pod/nginx-deployment-7969cc74c6-fpnnb   Pod sandbox changed, it will be killed and re-created.
<unknown>   Normal                    node/node01                             ^[[2J^[[3J^[[1;1H^[[m spoofed ^[[60C^[[1;0m. Done

I think the problem should be kubectl doesn't handle non-printing Characters.

I built an image daocloud.io/daocloud/test-escape:0.1.

The log contains the escape chars as well.

kubectl logs would have the same problem as well.
/sig cli

caesarxuchao · 2021-05-06T20:12:06Z

We'll let the sig-cli to take a pass first. Please re-tag sig-apimachinery if needed.

/remove-sig api-machinery

g3rzi · 2021-05-20T05:49:33Z

Any update on this issue?

g3rzi · 2021-05-31T07:53:27Z

Any updates?

soltysh · 2021-06-07T08:13:23Z

@g3rzi apologies, this slipped my attention, I'll have a look at it later this week
/assign

g3rzi · 2021-06-21T11:15:20Z

Hi @soltysh, did you have time to look at this issue?

g3rzi · 2021-06-28T05:36:09Z

Any update?

g3rzi · 2021-07-18T06:27:28Z

Hi @soltysh, did you have time to look at this issue?

g3rzi · 2021-08-11T08:38:36Z

Hi @soltysh, did you have time to look at this issue?
@caesarxuchao maybe you know?

palnabarun · 2021-09-08T10:41:46Z

cc: @RinkiyaKeDad

RinkiyaKeDad · 2021-09-08T10:43:46Z

I can also help with this 🙂

/assign

pacoxu · 2021-09-10T06:27:03Z

/triage accepted

soltysh · 2021-09-10T11:20:19Z

I spoke with @RinkiyaKeDad, he'll be looking at the this. In short I'm proposing to update

kubernetes/staging/src/k8s.io/cli-runtime/pkg/printers/json.go

Lines 37 to 82 in 758ad07

 func (p *JSONPrinter) PrintObj(obj runtime.Object, w io.Writer) error { 

 // we use reflect.Indirect here in order to obtain the actual value from a pointer. 

 // we need an actual value in order to retrieve the package path for an object. 

 // using reflect.Indirect indiscriminately is valid here, as all runtime.Objects are supposed to be pointers. 

 if InternalObjectPreventer.IsForbidden(reflect.Indirect(reflect.ValueOf(obj)).Type().PkgPath()) { 

 return fmt.Errorf(InternalObjectPrinterErr) 

 } 

 switch obj := obj.(type) { 

 case *metav1.WatchEvent: 

 if InternalObjectPreventer.IsForbidden(reflect.Indirect(reflect.ValueOf(obj.Object.Object)).Type().PkgPath()) { 

 return fmt.Errorf(InternalObjectPrinterErr) 

 } 

 data, err := json.Marshal(obj) 

 if err != nil { 

 return err 

 } 

 _, err = w.Write(data) 

 if err != nil { 

 return err 

 } 

 _, err = w.Write([]byte{'\n'}) 

 return err 

 case *runtime.Unknown: 

 var buf bytes.Buffer 

 err := json.Indent(&buf, obj.Raw, "", " ") 

 if err != nil { 

 return err 

 } 

 buf.WriteRune('\n') 

 _, err = buf.WriteTo(w) 

 return err 

 } 

 if obj.GetObjectKind().GroupVersionKind().Empty() { 

 return fmt.Errorf("missing apiVersion or kind; try GetObjectKind().SetGroupVersionKind() if you know the type") 

 } 

 data, err := json.MarshalIndent(obj, "", " ") 

 if err != nil { 

 return err 

 } 

 data = append(data, '\n') 

 _, err = w.Write(data) 

 return err 

 }

to properly handle escape chars handling. Looking at JSON spec I'd suggest using strconv.QuoteToASCII which was also proposed in this golang issue.

tallclair · 2021-11-19T21:37:50Z

IMO this should apply to all arbitrary strings output to a terminal by command line tools. It's probably simpler to just put a catch-all around kubectl output to escape control characters, but I'm not sure if kubectl intentionally uses control characters anywhere. I am neutral on whether the escaping should still be applied when the kubectl output is piped to another command.

I do NOT think the escaping should be applied server side. This is only an issue for tools outputting the data to a terminal.

BenTheElder · 2021-11-19T21:46:50Z

but I'm not sure if kubectl intentionally uses control characters anywhere.

kubectl uses ansi escape codes (color, bold ...) when printing warnings since #73032

RSAlderman · 2022-01-12T15:00:40Z

@RinkiyaKeDad that related issue #104962 (comment) closed waiting on solution design

Am I correct that there is currently no fix for this issue, assigned CVE-2021-25743?

RinkiyaKeDad · 2022-01-12T15:05:53Z

@RSAlderman from what I'm aware of, #104962 was the only PR out to fix this.

RSAlderman · 2022-01-12T15:26:12Z

@RinkiyaKeDad thanks for the prompt response. You said last week in #104962

The issue still needs to be fixed ...
will open a new PR once we've decided how to fix it exactly.

I presume that PR will be referenced from this issue when it is produced and then backported to 1.22 and 1.21 too?

RinkiyaKeDad · 2022-01-12T18:59:52Z

and then backported to 1.22 and 1.21 too

Sorry I'm afraid I don't know if this will happen or not. Let's wait for what others have to say 🙂
Also, just as an fyi, I'm not working on this currently and I don't think anyone else is too.

liggitt · 2022-01-19T22:56:06Z

As noted in #107617, this also applies to display of annotations

p-rog · 2022-01-21T14:34:26Z

Are there any news regarding potential patch to this vulnerability?
It seems that some fix in kubectl is the best option right now.

k8s-triage-robot · 2022-04-21T14:34:55Z

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

tallclair · 2022-04-22T17:23:55Z

/lifecycle frozen

alexanther1012 · 2022-05-20T14:04:33Z

there is currently no fix for this issue?, assigned to CVE-2021-25743

sayananavya · 2022-06-29T10:42:44Z

Team, Any fix for this vulnerability?
What packages need to be changed/updated??

Thanks in advance.

pacoxu · 2022-09-21T08:32:36Z

@dgl is working on this. #112553 is open.

DamianSawicki · 2023-10-30T17:30:08Z

@buckaroogeek asked about it already in the PR, but got no response for 11 months, so I'll ask again here: will the fix be applied to 1.25 and 1.24? @dgl @g3rzi

buckaroogeek · 2023-10-30T17:44:34Z

@DamianSawicki - thanks for checking again. I suspect this is almost moot. 1.24 is no longer supported and 1.25 end-of-life was supposed to be 2023.10.27.

dgl · 2023-10-30T22:49:31Z

It's unlikely this will be backported now. Note that a 1.25 cluster can be used with kubectl 1.26 per version skew policy and 1.24 on the cluster is likely fine too in this case, so given those are out of support it doesn't make sense to backport, just use a newer kubectl.

DamianSawicki · 2023-10-31T11:37:13Z

I see, thank you both for the answers!

g3rzi added the kind/bug Categorizes issue or PR as related to a bug. label May 2, 2021

k8s-ci-robot added needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels May 2, 2021

g3rzi changed the title ~~ANSI escape characters in Event JSON objects are not being filtered~~ ANSI escape characters in JSON Event objects are not being filtered May 2, 2021

k8s-ci-robot added sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels May 5, 2021

k8s-ci-robot added the sig/cli Categorizes an issue or PR as relevant to SIG CLI. label May 6, 2021

k8s-ci-robot removed the sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. label May 6, 2021

k8s-ci-robot assigned soltysh Jun 7, 2021

k8s-ci-robot assigned RinkiyaKeDad Sep 8, 2021

k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Sep 10, 2021

RinkiyaKeDad mentioned this issue Sep 13, 2021

filtering ANSI escape characters #104962

Closed

tallclair changed the title ~~ANSI escape characters in JSON Event objects are not being filtered~~ ANSI escape characters in kubectl output are not being filtered Nov 19, 2021

RinkiyaKeDad removed their assignment Jan 12, 2022

zishen mentioned this issue Jan 18, 2022

ANSI escape characters in kubectl output annotation are not being filtered - #107617

Closed

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Apr 21, 2022

k8s-ci-robot added lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Apr 22, 2022

dgl mentioned this issue Sep 19, 2022

Escape terminal special characters in kubectl #112553

Merged

raesene mentioned this issue Sep 25, 2022

Crafted CN fields in CSRs can create confusing results in kubectl output kubernetes/kubectl#888

Closed

k8s-ci-robot closed this as completed in #112553 Oct 30, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ANSI escape characters in kubectl output are not being filtered #101695

ANSI escape characters in kubectl output are not being filtered #101695

g3rzi commented May 2, 2021

g3rzi commented May 5, 2021

pacoxu commented May 6, 2021 •

edited

caesarxuchao commented May 6, 2021

g3rzi commented May 20, 2021

g3rzi commented May 31, 2021

soltysh commented Jun 7, 2021

g3rzi commented Jun 21, 2021

g3rzi commented Jun 28, 2021

g3rzi commented Jul 18, 2021

g3rzi commented Aug 11, 2021 •

edited

palnabarun commented Sep 8, 2021

RinkiyaKeDad commented Sep 8, 2021

pacoxu commented Sep 10, 2021

soltysh commented Sep 10, 2021

tallclair commented Nov 19, 2021

BenTheElder commented Nov 19, 2021

RSAlderman commented Jan 12, 2022

RinkiyaKeDad commented Jan 12, 2022

RSAlderman commented Jan 12, 2022

RinkiyaKeDad commented Jan 12, 2022

liggitt commented Jan 19, 2022

p-rog commented Jan 21, 2022

k8s-triage-robot commented Apr 21, 2022

tallclair commented Apr 22, 2022

alexanther1012 commented May 20, 2022

sayananavya commented Jun 29, 2022 •

edited

pacoxu commented Sep 21, 2022

DamianSawicki commented Oct 30, 2023

buckaroogeek commented Oct 30, 2023

dgl commented Oct 30, 2023

DamianSawicki commented Oct 31, 2023

ANSI escape characters in kubectl output are not being filtered #101695

ANSI escape characters in kubectl output are not being filtered #101695

Comments

g3rzi commented May 2, 2021

What happened:

What you expected to happen:

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know?:

Environment:

g3rzi commented May 5, 2021

pacoxu commented May 6, 2021 • edited

caesarxuchao commented May 6, 2021

g3rzi commented May 20, 2021

g3rzi commented May 31, 2021

soltysh commented Jun 7, 2021

g3rzi commented Jun 21, 2021

g3rzi commented Jun 28, 2021

g3rzi commented Jul 18, 2021

g3rzi commented Aug 11, 2021 • edited

palnabarun commented Sep 8, 2021

RinkiyaKeDad commented Sep 8, 2021

pacoxu commented Sep 10, 2021

soltysh commented Sep 10, 2021

tallclair commented Nov 19, 2021

BenTheElder commented Nov 19, 2021

RSAlderman commented Jan 12, 2022

RinkiyaKeDad commented Jan 12, 2022

RSAlderman commented Jan 12, 2022

RinkiyaKeDad commented Jan 12, 2022

liggitt commented Jan 19, 2022

p-rog commented Jan 21, 2022

k8s-triage-robot commented Apr 21, 2022

tallclair commented Apr 22, 2022

alexanther1012 commented May 20, 2022

sayananavya commented Jun 29, 2022 • edited

pacoxu commented Sep 21, 2022

DamianSawicki commented Oct 30, 2023

buckaroogeek commented Oct 30, 2023

dgl commented Oct 30, 2023

DamianSawicki commented Oct 31, 2023

pacoxu commented May 6, 2021 •

edited

g3rzi commented Aug 11, 2021 •

edited

sayananavya commented Jun 29, 2022 •

edited