CVE-2021-25740: 
MinimOS vulnerability analysis and mitigation

A security issue (CVE-2021-25740) was discovered in Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack. The vulnerability affects all Kubernetes versions and has been rated as Low severity with a CVSS v3.1 base score of 3.1 (Kubernetes Issue, NVD Database).

The vulnerability is related to Endpoints and EndpointSlices permissions in the Kubernetes API. If an attacker can create or edit Endpoints or EndpointSlices, they can potentially direct a LoadBalancer or Ingress implementation to expose backend IPs they shouldn't have access to. This is particularly concerning because if the target's NetworkPolicy already trusts the Load Balancer or Ingress implementation, NetworkPolicy cannot prevent exposure from other namespaces, potentially bypassing security controls such as LoadBalancerSourceRanges (Kubernetes Discussion).

The successful exploitation of this vulnerability could lead to disclosure of sensitive information. Services with an empty selector that rely on custom endpoints are particularly vulnerable to this attack. Additionally, a similar attack is possible using Ingress implementations that support forwarding to ExternalName Services, which can be used to forward to Services in other namespaces or sensitive endpoints within the Ingress implementation (Kubernetes Issue).

There is no direct patch for this issue as it is a design flaw. The recommended mitigation is to restrict write access to Endpoints and EndpointSlices by updating the system:aggregate-to-edit role. This involves removing write access to Endpoints from the admin and edit roles. For use-cases that need to edit these resources, it's recommended to create a new purpose-built Role with the desired permissions. Additionally, if using the Ingress API, it's recommended to confirm that the implementation either doesn't support forwarding to ExternalName Services or supports disabling the functionality (Kubernetes Issue).