Which vulnerability involves configuring a hostPath volume to retrieve sensitive information from the node?

Which vulnerability involves configuring a hostPath volume to retrieve sensitive information from the node?

• A. Accessing container
• B. Assessing master nodes
• C. Shrink Wrap Code Attack
• D. AWS pwn

Answer: (A)

Mounting a hostPath volume binds a directory from the node into a container. If this path is too broad or writable, a process inside the container can read sensitive files on the host, such as node credentials, tokens, and kubelet secrets. This lets an attacker inside the pod access information stored on the node, effectively exposing the host’s data from within the container. That’s why this option fits best: it describes the vulnerability where a pod’s access to the host’s filesystem leads to retrieving sensitive node information. The other choices don’t describe this host-to-node data exposure mechanism.

Mounting a hostPath volume binds a directory from the node into a container. If this path is too broad or writable, a process inside the container can read sensitive files on the host, such as node credentials, tokens, and kubelet secrets. This lets an attacker inside the pod access information stored on the node, effectively exposing the host’s data from within the container. That’s why this option fits best: it describes the vulnerability where a pod’s access to the host’s filesystem leads to retrieving sensitive node information. The other choices don’t describe this host-to-node data exposure mechanism.