aquasecurity / kube-hunter

Hunt for security weaknesses in Kubernetes clusters
Apache License 2.0
4.66k stars 579 forks source link

False positives on ExposedRunHandler #410

Closed danielsagi closed 3 years ago

danielsagi commented 3 years ago

Until now we relied on a Method not allowed response status code (405) when querying for a dummy request to the /run endpoint. While it is a sign that we passed Authorization, it does not mean that the endpoint is enabled. When debug handlers are disabled the status code remains the same. This resulted in a False positive, so even when debug handlers are disabled, we raised an ExposedRunHandler

The best way to check this is by getting the error message "pod does not exist"