CVEs-PoC/2020/CVE-2020-8555.md

### [CVE-2020-8555](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8555)
![](https://img.shields.io/static/v1?label=Product&message=Kubernetes&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.15%3C%201.15.12%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%20Server-Side%20Request%20Forgery%20(SSRF)&color=brighgreen)

### Description

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).

### POC

#### Reference
- https://hackerone.com/reports/776017

#### Github
- https://github.com/43622283/awesome-cloud-native-security
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Live-Hack-CVE/CVE-2020-8555
- https://github.com/Metarget/awesome-cloud-native-security
- https://github.com/Metarget/metarget
- https://github.com/SunWeb3Sec/Kubernetes-security
- https://github.com/adavarski/HomeLab-Proxmox-k8s-DevSecOps-playground
- https://github.com/adavarski/HomeLab-k8s-DevSecOps-playground
- https://github.com/atesemre/awesome-cloud-native-security
- https://github.com/cainzhong/cks-learning-guide
- https://github.com/iridium-soda/container-escape-exploits
- https://github.com/k1lly-git/k8s-audit
- https://github.com/kajogo777/kubernetes-misconfigured
- https://github.com/khu-capstone-design/kubernetes-vulnerability-investigation
- https://github.com/noirfate/k8s_debug
- https://github.com/reni2study/Cloud-Native-Security2
- https://github.com/walidshaari/cks