Var Log Escape

A pod running as root and with a mount point to the  /var/log directory within the host can expose the entire contents of its host filesystem to any user who has access to its logs.

info:

Blog info - https://blog.aquasec.com/kubernetes-security-pod-escape-log-mounts

Exploit small poc - https://hackerone.com/reports/1036886

Requirements:

1. Running as root inside the container
2. Kubernetes token with permission to query the nodes logs
3. Pod with a hostPath /var/log mount to the container

Exploit:

1. Symlink in the exploit pod (ln -s / /var/log/host/root_link) from /var/log/host/root_link to /
2. Send http request to kubelet logs end point which expose the entire root file system of the host