Tuesday, February 18, 2025
HomeCyber Security NewsGoogle Kubernetes Flaw Let Any Google User Control the Cluster

Google Kubernetes Flaw Let Any Google User Control the Cluster

Published on

SIEM as a Service

Follow Us on Google News

Researchers have discovered a new loophole in Google Kubernetes Engine (GKE), which threat actors can utilize with a Google account to take over the misconfigured Kubernetes Cluster. 

Threat actors can further use these compromised clusters for crypto mining, DoS (denial of service), and data theft. This loophole is dubbed “Sys:all” and affects more than 250,000 active GKE clusters, hundreds of them containing sensitive information.

This vulnerability exists due to the misconfiguration of RBAC bindings that result in system:authenticated groups having extreme privileges, potentially allowing any Google account holder to access and control vulnerable clusters.

Document
Run Free ThreatScan on Your Mailbox

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

Google Kubernetes Flaw

According to the reports shared with Cyber Security News, researchers conducted an internet-wide scan that identified thousands of clusters that could potentially be exploited, including some publicly traded companies.

Additionally, a Python script and a Google authentication token were used to interact with the Kubernetes API of these clusters.

Moreover, there were also attempts to map these clusters to their respective organizations, which could potentially reveal their owners and the impact that could be made.

Targeted Endpoints and Exploitation

Most of the targeted data points were configmaps, Kubernetes secrets, service account details, and other critical operational data, which could provide a significant amount of information for attacking an organization.

The results of exploiting the misconfigurations had many more implications, which included allowing list and pulling images from the container registries and open access to AWS credentials within a cluster’s configmap.

However, with these credentials, it was possible to access S3 buckets, which had several sensitive information and logs, which had admin credentials alongside several valuable endpoints such as RabbitMQ, Elastic, authentication server, and internal systems.

The most interesting part is that all of these endpoints could be accessed with administrator privilege.

RabbitMQ accessed with extracted credentials (Source: Orca Security)
RabbitMQ accessed with extracted credentials (Source: Orca Security)

Attack Flow

As of the initial access, the misconfigured GKE cluster allowed cluster-admin permissions to the system:authenticated group which enables querying multiple valuable resources using the Kubernetes API.

Inside the accessible resources, there were exposed AWS credentials (access key and secret key) within a bash script. This credential was further used to access S3 buckets for listing and downloading contents of multiple S3 buckets, some of which contained log files with operational data.

Exposed credentials (Source: Orca Security)
Exposed credentials (Source: Orca Security)

Following the examination of these logs, the researchers were able to find administrator credentials that can be used to log into various systems, including an internal platform.

Additionally, multiple important URLs to internal services such as ElasticSearch and RabbitMQ were also identified that could be accessed with superuser privileges.

Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Highly Obfuscated .NET sectopRAT Mimic as Chrome Extension

SectopRAT, also known as Arechclient2, is a sophisticated Remote Access Trojan (RAT) developed using...

Threat Actors Trojanize Popular Games to Evade Security and Infect Systems

A sophisticated malware campaign was launched by cybercriminals, targeting users through trojanized versions of...

New Research Aims to Strengthen MITRE ATT&CK for Evolving Cyber Threats

A recent study by researchers from the National University of Singapore and NCS Cyber...

New LLM Vulnerability Exposes AI Models Like ChatGPT to Exploitation

A significant vulnerability has been identified in large language models (LLMs) such as ChatGPT,...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Highly Obfuscated .NET sectopRAT Mimic as Chrome Extension

SectopRAT, also known as Arechclient2, is a sophisticated Remote Access Trojan (RAT) developed using...

Threat Actors Trojanize Popular Games to Evade Security and Infect Systems

A sophisticated malware campaign was launched by cybercriminals, targeting users through trojanized versions of...

New Research Aims to Strengthen MITRE ATT&CK for Evolving Cyber Threats

A recent study by researchers from the National University of Singapore and NCS Cyber...