Google Kubernetes Engine has been detected with two flaws that a threat actor can utilize to create significant damage in case the threat actor already has access inside the Kubernetes cluster.
The first issue was associated with FluentBit with default configuration.
FluentBit is GKE's logging agent that runs by default on all the clusters.
The second issue was linked to Anthos Service Mesh, which has default privileges.
If an attacker gains enough privilege inside a FluentBit container, which also has ASM installed, the threat actor can create an attack chain that could result in complete control over the Kubernetes cluster.
Post this, the threat actor can perform various actions such as data theft, deployment of malicious pods, or even disruption of the Kubernetes cluster's operations.
Google fixed this configuration issue in mid-December 2023.
In this step, each pod inside the FluentBit mounted volume contains a kube-api-access volume that has the projected service account token.
This token is used to communicate with the Kubernetes API, which is sensitive information.
If the FluentBit pod is compromised, the threat actor can use any token of any pod on the node.
The threat actor can also impersonate a pod and gain privileged access inside the Kubernetes API server, followed by several malicious actions such as mapping the entire cluster, listing all the running pods, etc.
This step involves the exploitation of ASM's Container Network Interface DaemonSet, which keeps excessive privileges after installation.
While ASM is enabled, Istio-cni-node DaemonSet is also installed in the cluster.
This Daemonset is used for installing and configuring the Istio CNI plugin on each node in the cluster, and it also has higher permissions to perform tasks.
To chain these exploits, the pod must have an ASM feature installed, and the threat actor must gain privileged access inside the Kubernetes cluster.
Once these two prerequisites are fulfilled, the threat actor can chain these exploits.
The threat actor can perform a task after taking control of the FluentBit container by exploiting the default configuration.
The threat actor can have access to the kube-api-access-
directory that has all the tokens from all the pods in the node.
From there, the threat actor can perform any malicious actions and gain complete control over the Kubernetes cluster.
A complete report about these two issues has been published by Palo Alto, providing detailed information about the privileges, concepts, exploitation, and other information.
This Cyber News was published on gbhackers.com. Publication date: Tue, 02 Jan 2024 13:43:04 +0000