CVE-2024-10220
HIGHKubernetes <1.28.11, 1.29.0-1.29.6, 1.30.0-1.30.2 - Command Injection
Title source: llmExploitation Summary
EIP tracks 8 public exploits for CVE-2024-10220. PoCs published by mrk336, mochizuki875, imohammed28.
AI-analyzed exploit summary The repository provides a detailed technical analysis of CVE-2024-10220, a Kubernetes gitRepo volume vulnerability allowing arbitrary command execution via malicious .hooks scripts. It includes a Python exploit PoC and deployment examples via Terraform/Ansible, but lacks functional exploit code.
Description
The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.
Exploits (8)
The repository provides a detailed technical analysis of CVE-2024-10220, a Kubernetes gitRepo volume vulnerability allowing arbitrary command execution via malicious .hooks scripts. It includes a Python exploit PoC and deployment examples via Terraform/Ansible, but lacks functional exploit code.
This repository demonstrates CVE-2024-10220, a vulnerability in Kubernetes GitRepo volumes that allows arbitrary file write via malicious Git hooks during repository cloning. The provided YAML deploys a Pod with a GitRepo volume pointing to a crafted repository, triggering the exploit.
This repository contains a functional proof-of-concept exploit for CVE-2024-10220, targeting Kubernetes gitRepo volumes to achieve arbitrary command execution on nodes. The exploit uses malicious Git hooks to demonstrate the vulnerability.
The repository contains only a minimal README with no exploit code, technical details, or functional proof-of-concept. It is a placeholder with no substantive content.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N