CriticalAPT
An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure
Securelist (Kaspersky)·Source published ·1 min read
What happened?
This article is published for educational purposes only, to raise awareness among information security professionals. The research was part of an official bug bounty program on a major platform. We notified the cloud provider about the vulnerabilities in line with our responsible disclosure policy, and all security issues we found were fixed in full. The infrastructure analyzed in this post has been anonymized, so the organization cannot be identified.
Key details
- A Konnectivity service token found on the worker node allowed interaction with the control plane tunnel service.
- The Konnectivity server on port 8132 accepted DIAL_REQ packets from the worker node and performed net.Dial on the control plane.
- This behavior created an SSRF primitive enabling access to host UNIX sockets such as D-Bus on the control plane.
- Mirantis, the company behind the k0s project, confirmed the vulnerability in Konnectivity.
Affected
- Managed Kubernetes cluster running k0s version v1.25.16+k0s.0
- Konnectivity server component inherited from apiserver-network-proxy in Kubernetes
- Control plane nodes running Ubuntu 22.04 with kernel 5.15.x and user namespaces enabled
Fixes and mitigations
- All security issues found were fixed in full by the cloud provider after responsible disclosure.
What to look for
- Creation of privileged pods with hostPID and privileged securityContext in managed Kubernetes clusters.
Summarised by SecOraLens from Securelist (Kaspersky). Always read the original source before acting. How SecOraLens verifies advisories.