AWS has patched a rather embarrassing Kubernetes bug

Date:
Wed, 13 Jul 2022 17:41:59 +0000

Description:
Letter capitalization bug could have led to escalated AWS Kubernete privileges.

FULL STORY ======================================================================

Amazon Web Services ( AWS ) has patched a rather embarrassing bug that could allow threat actors to gain elevated privileges on a Kubernetes cluster.

The bug was found in the IAM Authenticator for Kubernetes, a plugin tool used by Amazon EKS - a managed container service to run and scale Kubernetes applications.

Detailing its findings in a security advisory, AWS explained that the bug manifested when the authenticator plugin gets configured to use the AccessKeyID template parameter. In all other scenarios, users were not in harms way. Duplicate parameter names

The flaw was first discovered by Lightspin's Director of Security Research Gafnit Amiga. In a blog post , she noted: "I found several flaws in the authentication process that could bypass the protection against replay
attacks or allow an attacker to gain higher permissions in the cluster by impersonating other identities."

The flaw is tracked as CVE-2022-2385, Amiga further says, explaining that the code should check the capitalization of the parameter, but it doesnt, and
that leads to the bug. Threat actors can create duplicate parameter names,
and use them to gain elevated privileges.

Execution is easier said than done, though. "Because the for loop is not ordered, the parameters are not always overridden in the order we want, therefore we might need to send the request with the malicious token to the AWS IAM Authenticator server multiple times," Amiga concluded. Read more

Here's our take on the best firewalls today

Nearly half a million Kubernetes servers left open to the Internet

Kubernetes security report finds people have no idea how to use Kubernetes

All existing EKS clusters were patched late last month, while the new IAM Authenticator for the Kubernetes version is no longer vulnerable, requiring
no further action from the users. Still, those that host and manage their own Kubernetes clusters and use the IAM Authenticators AccessKeyID template parameter, should make sure the plugin is updated to 0.5.9.

The bug was first introduced in late 2017, but it wasnt until September 2020 that it was exploitable, she concluded. These are the best endpoint
protection services right now

Via: The Register



======================================================================
Link to news story: https://www.techradar.com/news/aws-has-patched-a-rather-embarrassing-kubernete s-bug/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)