## Summary
KubeSphere versions through 4.1.3 contain a server-side request forgery (SSRF) in the git credential verification endpoint. An authenticated attacker can provide arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace via error-response handling.
## Technical Details
- Vulnerability type: SSRF (CWE-918) in the “git credential verification” endpoint.
- Root issue (per NVD): the endpoint accepts caller-supplied URLs without allowlist restrictions.
- Attack prerequisites (per NVD): attacker must be authenticated (PR:L) and can be low complexity (AC:L).
- Exploitation behavior (per NVD): attacker supplies arbitrary URLs so the server-side component can make requests to internal services.
- Data exposure mechanism (per NVD): the endpoint’s error response handling can be leveraged to extract basic-auth credentials from Kubernetes Secrets across any namespace.
- Impact scope: confidentiality impact is high (C:H), integrity/availability are not indicated as directly affected (I:N, A:N).
## Affected
- KubeSphere: through 4.1.3.
## Impact
- Credential theft: exfiltration of basic-auth credentials from Kubernetes Secrets in any namespace.
- SSRF enables internal network reachability from the KubeSphere server context.
## Mitigation
1. Patch KubeSphere to a version that fixes the SSRF in the git credential verification endpoint (upgrade beyond 4.1.3).
2. Restrict access to the affected endpoint to the minimum required authenticated roles (reduce PR:L exposure).
3. Add/verify URL allowlisting and egress controls at the application and network layers to prevent requests to internal addresses from user-controlled URL inputs.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-918