Amazon Web Services (AWS) has patched a rather embarrassing bug that could allow threat actors to gain elevated privileges on a Kubernetes cluster.
The bug was found in the IAM Authenticator for Kubernetes, a plugin tool used by Amazon EKS – a managed container service to run and scale Kubernetes applications.
Detailing its findings in a security advisory, AWS explained that the bug manifested when the authenticator plugin gets configured to use the AccessKeyID template parameter. In all other scenarios, users were not in harm’s way.
Duplicate parameter names
The flaw was first discovered by Lightspin’s Director of Security Research Gafnit Amiga. In a blog post (opens in new tab), she noted: “I found several flaws in the authentication process that could bypass the protection against replay attacks or allow an attacker to gain higher permissions in the cluster by impersonating other identities.”
The flaw is tracked as CVE-2022-2385, Amiga further says, explaining that the code should check the capitalization of the parameter, but it doesn’t, and that leads to the bug. Threat actors can create duplicate parameter names, and use them to gain elevated privileges.
Execution is easier said than done, though. “Because the for loop is not ordered, the parameters are not always overridden in the order we want, therefore we might need to send the request with the malicious token to the AWS IAM Authenticator server multiple times,” Amiga concluded.
All existing EKS clusters were patched late last month, while the new IAM Authenticator for the Kubernetes version is no longer vulnerable, requiring no further action from the users. Still, those that host and manage their own Kubernetes clusters and use the IAM Authenticator’s AccessKeyID template parameter, should make sure the plugin is updated to 0.5.9.
The bug was first introduced in late 2017, but it wasn’t until September 2020 that it was exploitable, she concluded.
