Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Fabric Scape: Escaping Service Fabric and Taking Over the Cluster

Summary: Unit 42 researchers identified FabricScape (CVE-2022-30137), an important-severity flaw in Microsoft's Service Fabric that lets Linux containers escalate to root on a node and then compromise every node in the cluster, and they exploited it successfully against the Azure Service Fabric offering on versions 8.2.1124.1, Ubuntu 16.04 and 18.04. The mechanism is a symlink race in the root-running Data Collection Agent's GetIndex function, triggered by a container creating a ProcessContainerLog.txt file, which the researchers won consistently by padding the malicious file to 10 MB; Microsoft fully fixed the issue on June 14, 2022.

What you should know: Service Fabric hosts more than 1 million applications and runs millions of cores daily, and the researchers used the root access to reach the cluster certificate in /var/lib/waagent/ and authenticate to the REST API on port 19080, which is open to the internet by default in Azure Service Fabric.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2022-30137
Related