Kubernetes · Report #908880
Private IP addresses Disclosure
Informativestatus
1upvotes
23 Jul 2020disclosed
How it was found
The following URL leaks the Private IP Addresses:- kubernetes.io/feed.xml
The following Server’s Cluster RFC 1918 IP addresses were disclosed in the response: • 10.1.2.3 • 10.104.207.136 • 10.224.0.0 • 10.250.0.0 • 10.250.112.0 • 10.250.96.0 • 10.55.252.216 • 10.96.0.0 • 10.96.0.1 • 10.96.15.180 • 10.97.125.254 • 10.97.62.68 • 172.17.0.4 • 192.168.1.4 • 192.168.1.7 • 192.168.99.100
Steps to reproduce:- Simply by opening the above mentioned link we can extract the server's Cluster IP Addresses.
References:- Attached Snaps
CWE-200: Information Exposure
Impact
Attackers can use this information to exploit the ip addresses.