Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Demystifying Kubernetes CVE-2018-1002105 (and a dead simple exploit)

Summary: Kubernetes maintainers disclosed CVE-2018-1002105, a critical flaw in the kube-apiserver's UpgradeAwareHandler that lets an attacker who can send one authorized request keep sending arbitrary requests over the same connection, authenticated with the API server's own TLS credentials and bypassing authorization. Because default RBAC permits anonymous discovery calls against aggregated API servers, and metrics-server is deployed by default since Kubernetes 1.8, the researcher built a Ruby proof-of-concept run from a fresh nginx pod that impersonated the system:serviceaccount:kube-system:horizontal-pod-autoscaler account and returned a JSON list of pods across all namespaces.

What you should know: The exploit needed no special prerequisites beyond access to the API server, which every pod has by default, and the impersonation header let it escalate to any service account in scope - so a single compromised pod could enumerate the whole cluster.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Cloud Security
Mentions
CVE-2018-1002105
Related