Mounting a #Kubernetes service account to a pod with permissions to deploy other pods implies that if your app has RCE, a threat actor will be able to infect other Services in the cluster (yes, even if you use strict PSPs) #KubernetesSecurity #k8s #aks #gke #eks
#DevSecOps
🧵 👇
#DevSecOps
🧵 👇
Background:
▪︎ A Service in #k8s is an object that balances HTTP requests between pods belonging to that Service
▪︎ A Service identifies its pods through a set of labels (e.g. "fancy-app: prod", "db: users", etc)
▪︎ A Service in #k8s is an object that balances HTTP requests between pods belonging to that Service
▪︎ A Service identifies its pods through a set of labels (e.g. "fancy-app: prod", "db: users", etc)
▪︎ A pod with a label associated with a Service will become part of that Service automatically
Attack scenario:
1. A pod is mounting a service account with permissions to deploy other pods
2. A container in the pod is running a vulnerable app, providing RCE to an attacker
Attack scenario:
1. A pod is mounting a service account with permissions to deploy other pods
2. A container in the pod is running a vulnerable app, providing RCE to an attacker
3. The attacker identifies an interesting Service in the cluster with label "backend: v1", which looks like some kind of REST API service
4. The attacker deploys a new pod with label "backend: v1"
5. The pod automatically becomes part of the "backend: v1" Service
4. The attacker deploys a new pod with label "backend: v1"
5. The pod automatically becomes part of the "backend: v1" Service
6. Traffic to the "backend: v1" Service is now partly load-balanced to the attacker's pod
7. Plain-text credentials, tokens and cookies submitted to the Service can be now be stolen by the attacker when traffic is sent to their pod
#Kubernetes #BugBounty #Pentesting
7. Plain-text credentials, tokens and cookies submitted to the Service can be now be stolen by the attacker when traffic is sent to their pod
#Kubernetes #BugBounty #Pentesting
Extra:
▪︎ For stealthier attacks, the attacker can even deploy a pod that simply logs the received traffic, and forwards it to one of the other pods in the Service to serve legitimate responses to the original user. Note that this is not always straightforward though
▪︎ For stealthier attacks, the attacker can even deploy a pod that simply logs the received traffic, and forwards it to one of the other pods in the Service to serve legitimate responses to the original user. Note that this is not always straightforward though
• • •
Missing some Tweet in this thread? You can try to
force a refresh
