Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Container Escape to Shadow Admin: GKE Autopilot Vulnerabilities

Summary: Unit 42 researchers disclosed several vulnerabilities and attack techniques in GKE Autopilot to Google in June 2021, which a user able to create a pod could have chained to escape the pod, compromise the underlying node, escalate to full cluster administrator, and install backdoors invisible to cluster operators. Google fixed the reported issues and deployed patches universally across GKE, so all Autopilot clusters are now protected.

What's compelling: The escalation path relied on default kube-system pods - stackdriver-metadata-agent-cluster-level and metrics-server - that are also deployed by default in GKE Standard, so the privilege escalation technique was relevant to all GKE clusters, not just Autopilot. An attacker who started with a compromised developer account could become a shadow administrator able to exfiltrate secrets, deploy malware or cryptominers, and disrupt workloads without appearing in the operator's view.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related