mirror of
https://github.com/kubernetes/kubernetes.git
synced 2026-11-06 05:17:08 +00:00
zylxjtu
71e776e87e
The subPath symlink resolver on Windows only treated the \?\ and \.device forms as non-followable and let ordinary UNC paths such as \attacker\share through. Following such a target makes the node open an SMB session and automatically send its credentials, enabling forced NTLM authentication (MITRE ATT&CK T1187) via an attacker-controlled subPath. Treat any path beginning with \ as a device/UNC path so it is never followed. Add TestIsDeviceOrUncPath covering the UNC, device and volume forms plus a local-path negative case. (cherry picked from commit 3d277f71b3c6824c1a2d768b4ca54f0dbacfc6a9)