Finding Azurescape – Cross-Account Container Takeover in Azure Container Instances
Summary: Unit 42 researchers found that Azure Container Instances ran an outdated runC (v1.0.0-rc2, released Oct. 1, 2016) vulnerable to container-breakout CVEs, letting them escape to a Kubernetes node and obtain a 'bridge' service account token with cluster-wide pods/exec rights. With code execution on the api-server, they achieved what they call the first cross-account container takeover in the public cloud, able to control other customers' containers; Microsoft patched ACI shortly after disclosure and Unit 42 has no knowledge of exploitation in the wild.
What you should know: A single stolen service account token with pods/exec rights turned one customer's container into admin control over a multitenant cluster hosting roughly 100 customer pods, so Unit 42 recommends revoking any privileged credentials deployed to ACI before Aug. 31, 2021 and checking access logs for irregularities.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2019-5736
- Related
- Breaking Out of rkt – 3 New Unpatched CVEs Cyber Risks ·