A high-severity vulnerability in KubePlus 4.1.4 allows an authenticated attacker with high privileges to perform Server-Side Request Forgery and arbitrary HTTP header injection.

This vulnerability resides in the mutating webhook and kubeconfiggenerator components, where the chartURL field is improperly handled. An attacker with high privileges can exploit this to perform SSRF attacks or inject malicious HTTP headers by leveraging an insecure concatenation of the chartURL during wget operations.

The CVSS score of 7.6 reflects the significant risk posed by this flaw, particularly regarding the potential for unauthorized data access and internal network reconnaissance. Successful exploitation could allow attackers to bypass security controls, interact with internal services that are not externally accessible, and potentially compromise the integrity of the KubePlus deployment.

Immediate Action: Monitor vendor communications closely for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review cluster access logs for anomalous requests to the mutating webhook or unexpected outgoing traffic originating from the kubeconfiggenerator component.

Compensating Controls: Restrict network access for the affected components using Kubernetes network policies to prevent unauthorized outbound connections to sensitive internal endpoints.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the linked GitHub repository.

Given the availability of a public proof-of-concept and the high-severity nature of this flaw, administrators must treat this as a priority. While a formal patch is currently pending, implementing network-level segmentation to limit the impact of potential SSRF and header injection is essential to maintaining cluster security until an official fix is deployed.