一句话：首个针对 Kubernetes 资源注入漏洞的大规模实证研究，揭示其字段、成因、特权操作与修复策略。
Kubernetes 通过资源定义声明期望状态，并由控制器执行调和，但控制器可能未经充分校验就使用用户可控字段执行特权操作，导致资源注入漏洞，可被用于未授权访问与权限提升。论文从常见漏洞数据库中收集 8,306 个 Kubernetes 相关漏洞，筛选并系统研究 125 个资源注入漏洞，分析其易受攻击字段、根本原因、涉及的特权操作、利用条件及修复策略。研究给出了一系列发现，为资源注入漏洞的检测、缓解以及更安全的云原生应用开发提供指导。
Cloud-native technologies have revolutionized application development, with Kubernetes emerging as the de facto standard platform for containerization and orchestration. Kubernetes manages applications through API objects called resources, where users declare desired states via resource definitions that are processed by controllers to reconcile system discrepancies. However, this resource-based architecture introduces resource injection vulnerabilities, where controllers perform privileged operations using user-controllable fields without adequate validation. Attackers can exploit these weaknesses by injecting malicious content into resource fields to achieve unauthorized access and privilege escalation.In this paper, we conduct the first comprehensive study on 125 resource injection vulnerabilities from 8,306 Kubernetes-related vulnerabilities across common databases. For all studied vulnerabilities, we investigate their vulnerable fields, root causes, privileged operations, exploitation conditions, and fixing strategies. Our study reveals many interesting findings that can guide the detection and mitigation of resource injection vulnerabilities, as well as the development of more secure cloud-native applications.
DOI 原文 ·
@inproceedings{paperbot9223,
title = {Understanding Resource Injection Vulnerabilities in Kubernetes Ecosystems},
author = {Defang Bo and Jie Lu and Feng Li and Jingting Chen and Jinchen Wang and Chendong Yu and Yeting Li and Wei Huo},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00220}
}