AWS has patched a rather embarrassing Kubernetes bug

News
By
published

Letter capitalization bug could lead to escalated AWS Kubernetes privileges

coding
(Image credit: Pixabay)

Amazon Web Services (AWS) has patched a rather embarrassing bug that could allow threat actors to gain elevated privileges on a Kubernetes cluster. 

The bug was found in the IAM Authenticator for Kubernetes, a plugin tool used by Amazon EKS - a managed container service to run and scale Kubernetes applications.

Detailing its findings in a security advisory, AWS explained that the bug manifested when the authenticator plugin gets configured to use the AccessKeyID template parameter. In all other scenarios, users were not in harm’s way. 

Duplicate parameter names

The flaw was first discovered by Lightspin's Director of Security Research Gafnit Amiga. In a blog post, she noted: "I found several flaws in the authentication process that could bypass the protection against replay attacks or allow an attacker to gain higher permissions in the cluster by impersonating other identities."

The flaw is tracked as CVE-2022-2385, Amiga further says, explaining that the code should check the capitalization of the parameter, but it doesn’t, and that leads to the bug. Threat actors can create duplicate parameter names, and use them to gain elevated privileges. 

Execution is easier said than done, though. "Because the for loop is not ordered, the parameters are not always overridden in the order we want, therefore we might need to send the request with the malicious token to the AWS IAM Authenticator server multiple times," Amiga concluded.

Read more

> Here's our take on the best firewalls today

> Nearly half a million Kubernetes servers left open to the Internet

> Kubernetes security report finds people have no idea how to use Kubernetes

All existing EKS clusters were patched late last month, while the new IAM Authenticator for the Kubernetes version is no longer vulnerable, requiring no further action from the users. Still, those that host and manage their own Kubernetes clusters and use the IAM Authenticator’s AccessKeyID template parameter, should make sure the plugin is updated to 0.5.9.

The bug was first introduced in late 2017, but it wasn’t until September 2020 that it was exploitable, she concluded.

Via: The Register

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.