Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Windows Server Containers Are Open, and Here's How You Can Break Out

Summary: Unit 42 researchers found that Windows Server Containers are not designed for sandboxing and that escaping them is easy, using an undocumented symbolic link flag that resolves paths on the host's root directory rather than the container's. The technique lets processes inside a container write files to the host, which can be leveraged for remote code execution, and in Kubernetes environments could spread between nodes and reach a complete production workload after breaching just one endpoint instance.

Why it matters: Microsoft's own guidance is that users should not run anything in a Windows Server Container they wouldn't be willing to run as admin on the host, which means every Windows container workload on AKS and other cloud providers should be treated as host-level access for anyone who breaches a single application instance.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related